Engaging in cooperation and information sharing with partners abroad is important to better understand and respond to a constantly changing threat environment. Given the importance of international cooperation on cybersecurity, the CSIRTs should be able to participate in international cooperation networks in addition to the CSIRTs network established by the NIS2 Directive.
CCB European and international cybersecurity cooperation: The CCB coordinates Belgium’s representation and policy input across European and international cybersecurity forums. At EU level, it represents Belgium in the NIS Cooperation Group, supports the Belgian Permanent Representation in the Council’s Horizontal Working Party on Cyber Issues, participates in ENISA governance (via ENISA MB, NLO and some expert groups led by ENISA), it is a member of the European Cybersecurity Certification Group (ECCG) and it is designated as National Cybersecurity Coordination Centre for Belgium (NCC-BE) in the framework of EU Regulation 2021/887 and therefore participates in the works of the ECCC/NCC network. Internationally, it acts as Belgium’s operational contact for the OSCE cyberspace working group, participates in the Counter Ransomware Initiative and its task force, and provides expertise for NATO, UN, OECD and ITU discussions. The CCB also participates in operational networks including the EU CSIRTs Network, EGC, FIRST, TF-CSIRT and EU-CyCLONe. The CCB additionally supports cyber-capacity-building projects with partner countries through Enabel and the Global Forum on Cyber Expertise.
Sources: https://ccb.belgium.be/organisation/collaborations/international-relations
International cyber-capacity building and bilateral cooperation: The CCB converts international cooperation into practical capacity-building with partner authorities and professional communities. Through Enabel and other partners, it has supported cybercrime capability and public awareness in Benin, health-sector cyber hygiene in Senegal, responses to technology-facilitated gender-based violence in Morocco, digital-rights and cybersecurity skills in Uganda, and youth cyber-awareness activities in Palestine. It also contributes to the Global Forum on Cyber Expertise and delivered advanced MISP training with Lithuanian experts for participants from 32 countries under the Counter Ransomware Initiative.
Sources: https://ccb.belgium.be/organisation/collaborations/international-relations
CERT.hr international CSIRT cooperation: Croatia's national CERT is its point of contact for international incident-response cooperation. Operated within CARNET, CERT.hr is a member of the EU CSIRTs Network, of FIRST (Forum of Incident Response and Security Teams, since 2009), and of TF-CSIRT, and has been Trusted Introducer-accredited since 2010. Through these it exchanges incident information and coordinates cross-border response with other national CSIRTs and CERT-EU. It cooperates with foreign CSIRTs on threats, vulnerabilities and incidents affecting the .hr domain and Croatian IP space.
Sources: https://www.cert.hr/onama/
https://www.cert.hr/en/home-page/
https://tf-csirt.org/trusted-introducer/directory/teams/certhr/
EU cybersecurity cooperation: Croatia coordinates and represents its national position in the EU cybersecurity bodies established under NIS2. NCSC-HR (within SOA) is the central authority and, together with the Office of the National Security Council (UVNS), acts as Croatia's single point of contact toward the EU. NCSC-HR is Croatia's cyber crisis liaison (Croatian CyCLO) in the EU-CyCLONe network and participates in the NIS Cooperation Group (strategic level), aligning national policy and coordinating cross-border crisis response, and cooperates with CERT-EU.
Sources: https://ncsc.hr/en
https://ncsc.hr/
https://ncsc.hr/UserDocsImages/ostalo/Cybersecurity_Act.pdf?vel=1434556
National Coordination Centre for Cybersecurity (NCC-DK): NCC-DK serves as Denmark's National Coordination Centre for Cybersecurity and works with the European Cybersecurity Competence Centre (ECCC) and the European network of National Coordination Centres. It promotes cooperation among authorities, businesses and research organisations and supports Danish participation in European cybersecurity initiatives and funding programmes.
Sources:https://ncc-dk.dk/om-os/kontakt/
https://cybersecurity-centre.europa.eu/national-coordination-centre-cybersecurity-denmark-ncc-dk_en
The DanishResilience Agency (SAMSIK): International cooperation is a formal responsibility of SAMSIK. The agency is responsible for cooperation relating to societal security, preparedness, cybersecurity and resilience, including cooperation with the European Union, NATO and Nordic countries.
Sources:https://mssb.dk/ministeriet/styrelsen-for-samfundssikkerhed/
https://samsik.dk/en/
EU cybersecurity cooperation: Denmark’s national CSIRT and Government CERT is placed in the Danish Defence Intelligence Service (DDIS).. Through its participation in the EU CSIRTs Network, DDIS cooperates with national CSIRTs across Europe on incident response, cross-border incident coordination, information exchange, good practices and coordinated vulnerability disclosure.
Sources:https://tf-csirt.org/trusted-introducer/directory/teams/cfcs/
https://www.fe-ddis.dk/da/arbejdsomrade-a/Cybertruslen/
Nordic-Baltic Cross-Border Cyber-Hub (NBCC): The 2026–2029 NBCC project links cybersecurity authorities from Latvia, Lithuania, Estonia, Finland, Iceland, Norway and Denmark. It will establish regional data sharing and shared cyber-threat-intelligence capabilities and foster cooperation with private and research actors.
Sources: https://www.cert.gov.lv/en/about-us/international-projects
International cyber cooperation through NATO CCDCOE and Locked Shields: Estonia hosts the NATO Cooperative Cyber Defence Centre of Excellence in Tallinn. In practice, the centre brings together participating nations for research, training and policy development. Its annual Locked Shields exercise allows multinational teams to practise the defence of complex digital systems under realistic conditions. Hosting the centre gives Estonia a central role in international cyber defence cooperation and collective learning.
Sources: https://ccdcoe.org/
EU cybersecurity cooperation: Estonia participates in EU cybersecurity cooperation spanning operational assistance, capacity building, and diplomacy. RIA leads EU CyberNet for international capacity building, NCSC-EE represents Estonia in the EU CSIRTs Network (and EU-CyCLONe), and the Ministry of Foreign Affairs leads engagement in international policy forums.
Sources: https://www.ria.ee/en/cyber-security/international-projects
Nordic-Baltic Cross-Border Cyber-Hub (NBCC): The 2026–2029 NBCC project links cybersecurity authorities from Latvia, Lithuania, Estonia, Finland, Iceland, Norway and Denmark. It will establish regional data sharing and shared cyber-threat-intelligence capabilities and foster cooperation with private and research actors.
Contributing to the EU cybersecurity cooperation: Finland actively participates in EU cybersecurity cooperation, aligning its national work with the EU Cybersecurity Strategy. Operationally, NCSC-FI represents Finland in the EU CSIRTs Network and EU-CyCLONe, exchanging threat intelligence and coordinating cross-border incident responses across the Union.
Sources: https://kyberturvallisuuskeskus.fi/en/our-services/situation-awareness-and-network-management
EU CyCLONe | ENISA
Participating in the Nordic-Baltic Cross-Border Cyber-Hub (NBCC): The 2026–2029 NBCC project links cybersecurity authorities from Latvia, Lithuania, Estonia, Finland, Iceland, Norway and Denmark. It will establish regional data sharing and shared cyber-threat-intelligence capabilities and foster cooperation with private and research actors.
Sources: https://www.cert.gov.lv/en/about-us/international-projects
Cyber foreign and security policy (Federal Foreign Office): The Federal Foreign Office leads Germany's international engagement on cyber issues. It promotes the framework of responsible state behaviour in cyberspace, contributes to the relevant United Nations processes and to the EU cyber-diplomacy toolbox, and pursues capacity-building and confidence-building measures with partner states.
Sources: https://www.auswaertiges-amt.de/en/aussenpolitik/themen/cyberaussenpolitik
https://www.auswaertiges-amt.de/de/aussenpolitik/themen/cyberaussenpolitik
BSI / CERT-Bund international cooperation: At operational level the BSI and CERT-Bund cooperate with partner authorities and CERTs bilaterally and in international networks, including the EU CSIRTs Network and the global FIRST community. This supports joint situational awareness, coordinated vulnerability handling and mutual assistance during cross-border incidents.
Federal Ministry for Economic Cooperation and Development (BMZ): Germany finances and leads digital development initiatives globally, focusing on building independent digital infrastructures with international partners.
Sources: https://d4dhub.eu/data-governance-in-africa-digital-investment-facility
Federal Foreign Office: Germany supports partner nations in establishing their own CSIRTs, hardening critical links, and reinforcing regional cybersecurity resilience.
Sources: https://www.giz.de/en/projects/partnership-strengthening-cybersecurity-ii
National Cyber Security Centre of Hungary (NCSC HU) international CSIRT cooperation (FIRST, Trusted Introducer, EU CSIRTs Network): Hungary's national CSIRT is its point of contact for international incident-response cooperation. The National Cyber Security Centre of Hungary (NCSC HU), within the Special Service for National Security (SSNS), is a full member of FIRST (Forum of Incident Response and Security Teams, since December 2013) and is accredited in the TF-CSIRT Trusted Introducer directory, which also lists it as a full member of the EU CSIRTs Network. Through these it exchanges incident information and coordinates cross-border response with other national CSIRTs and CERT-EU on threats, vulnerabilities and incidents affecting Hungarian networks.
Sources: https://www.first.org/members/teams/ncsc_hungary
https://www.trusted-introducer.org/trusted-introducer/directory/teams/ncsc-hungary/
EU Cybersecurity Cooperation: Hungary coordinates and represents its national position in the EU cybersecurity bodies established under NIS2. The National Cyber Security Centre of Hungary (NCSC HU) operates Hungary's national contact point (single point of contact), which coordinates the domestic handling of high-impact cross-border cyber incidents within the EU and ensures the reception and forwarding of reports to international partners. NCSC HU represents Hungary in the EU cyber crisis liaison network (EU-CyCLONe) and participates in the EU CSIRTs Network; its international and EU work is supported by the International and EU sub-working group led by the Ministry of Foreign Affairs and Trade. NCSC HU also cooperates with CERT-EU.
Sources: https://kibernaptar.hu/szervezo/nbsz-nki/
https://nki.gov.hu/intezet/tartalom/magunkrol/
https://en.nki.gov.hu/
https://njt.jog.gov.hu/jogszabaly/en/2024-69-00-00
CSIRT.LI as International Point of Contact (PoC): In the role of a national CSIRT within the NIS framework, the CSIRT.LI acts as the international point of contact (PoC) and functions as the national cyber security incident response coordinator.
Sources: https://www.llv.li/en/national-administration/national-cyber-security-unit/csirt
https://www.llv.li/de/landesverwaltung/stabsstelle-cybersicherheit/csirt
Budapest Convention on Cybercrime Implementation: Liechtenstein participates in the Council of Europe Convention on Cybercrime (Budapest Convention). The Government's ratification documentation identifies international cooperation, mutual legal assistance and coordinated action against cybercrime as core objectives of the Convention.
CSIRT Malta participation in European cooperation mechanisms: CSIRT Malta participates in the CSIRTs Network and the European Cooperation Group to ensure effective, efficient and secure cooperation at European level.
Sources: https://maltacip.gov.mt/en/the-department/csirtmalta/
https://maltacip.gov.mt/dipartimenti/disclamer/
Cyber Threat Intelligence Team (CTI) and govmtCSIRT international cooperation activities: The Cyber Threat Intelligence Team and govmtCSIRT coordinate activities with Maltese and international CSIRTs and CERTs, participate in national and international cybersecurity forums, develop and maintain bilateral agreements with national and international CSIRTs, CERTs and organisations, and participate in local and foreign CERT/CSIRT communities.
International cybercrime cooperation: Malta is intensifying collaboration with international law enforcement and judicial organisations including INTERPOL, Europol and Eurojust, while actively participating in the SIENA secure information-sharing platform. The measure supports cross-border cooperation, information exchange and coordinated action against cybercrime and emerging cyber threats.
Sources: https://www.gov.mt/en/Government/DOI/Press%20Releases/Pages/2025/06/04/PR250970en.aspx
ATHENA Trans-National SOC Initiative (ATHENA Project): Malta participates in the ATHENA Trans-National Security Operations Centre initiative, which aims to enhance cross border cybersecurity cooperation, cyber threat information sharing, and collaborative detection and response capabilities among participating countries (Bulgaria, Greece and Cyprus). The project supports operational cooperation between national cybersecurity authorities and SOCs across Europe.
Sources: https://soc-athena.eu/malta/
EU cybersecurity cooperation: NCSC-NL represents the Netherlands in EU cybersecurity cooperation frameworks, including the EU CSIRTs Network and EU-CyCLONe. Through these mechanisms, it exchanges technical information, coordinates cross-border incident response, and provides peer assistance, giving the Netherlands an operational channel for European cooperation during incidents.
Source: https://www.ncsc.nl/over-ons/versterkt-ncsc
Cyber diplomacy: The International Cyber Strategy guides Dutch diplomatic engagement on an open, free and secure internet, international law, human rights and collective responses to malicious cyber activity. In practice, the Ministry of Foreign Affairs leads this work with support from NCTV and specialist agencies. The strategy complements operational CSIRT cooperation by addressing the political and diplomatic dimensions of international cybersecurity.
ENSOC Consortium Membership: The NCSC represents the Netherlands in ENSOC, leading the consortium's platform validation, cross-border testing frameworks, and the procurement of global Cyber Threat Intelligence (CTI).
Source: https://www.ensoc.eu/
Poland’s multilateral cybersecurity cooperation: The Ministry of Digital Affairs coordinates Poland’s international cybersecurity policy through bilateral relations and multilateral forums. It represents Poland in EU policy mechanisms including the Horizontal Working Party on Cyber Issues and the NIS Cooperation Group, and cooperates through NATO, the OSCE, ENISA, ECSO and the Central European Cyber Security Platform. These channels support common policy positions, exchange of good practices and coordination of regional and European cybersecurity priorities.
Sources: https://www.gov.pl/web/cyfryzacja/wspolpraca-miedzynarodowa1
EU Cybersecurity Cooperation: CERT Polska represents Poland in EU operational cybersecurity cooperation frameworks, including the EU CSIRTs Network and EU-CyCLONe. Through these mechanisms, it exchanges technical threat information, coordinates cross-border incident response, and provides peer assistance, giving Poland a direct operational channel for European cooperation during incidents.
Sources: https://cert.pl/en/about-us/
https://cert.pl/en/faq/
EU Cybersecurity Cooperation: CERT.PT, integrated within the National Cybersecurity Centre (CNCS), represents Portugal in the European CSIRTs Network. CNCS also participates in other European Union forums and work streams, related to ENISA and European Commission activities.
Sources: https://www.cncs.gov.pt/en/certpt/
https://www.cncs.gov.pt/pt/certpt/
National Coordination Centre Portugal (NCC-PT): NCC-PT plays a crucial role in the national and European cybersecurity landscape as it actively contributes to increasing the visibility of national cybersecurity products and services within the European ecosystem, thus promoting greater European digital sovereignty.
Sources: https://www.cncs.gov.pt/en/ncc-pt-centro-nacional-de-coordenacao/
https://www.cncs.gov.pt/pt/ncc-pt/
Counter Ransomware Initiative: Portugal is a partner in The International Counter Ransomware Initiative (CRI). The CRI strengthens collective resilience against ransomware by fostering cooperation, disrupting criminal ransomware networks, and developing policy measures to address this growing threat. Created in 2021, the initiative recognizes that no organisation, regardless of its expertise or resources, can effectively tackle ransomware on its own. Through international collaboration, the CRI enhances the ability of its members to identify, prevent, and disrupt malicious actors and the ecosystems that support ransomware operations.
Sources: https://counter-ransomware.org/
European Cybersecurity Cooperation: NBÚ participates in European cybersecurity cooperation mechanisms including ENISA, the NIS Cooperation Group, CyCLONe, the European CSIRTs Network Horizontal Working Party on Cyber Issues (EU Council) and EU institutional structures. These mechanisms support cybersecurity policy development, NIS2 implementation, cyber crisis management, coordinated response to large scale incidents, operational CSIRT cooperation, certification and cyber resilience. The Director of the National Cybersecurity Centre is a member of the ENISA Management Board.
Sources: https://www.nbu.gov.sk/international-collaboration/
https://www.nbu.gov.sk/medzinarodna-spolupraca/
International Cybersecurity and Security Partnerships: NBÚ cooperates with international organisations and security cooperation structures including NATO, the United Nations (UN), the Organisation for Security and Co-operation in Europe (OSCE), OECD, the Council of Europe, EUROPOL and CERT-EU.
Sources: https://www.nbu.gov.sk/international-collaboration/
https://www.nbu.gov.sk/medzinarodna-spolupraca/
International Public-Private Partnerships and Bilateral Cooperation Agreements: NBÚ participates in international public-private cooperation through ECSO, the Network of National Coordination Centres and professional cybersecurity communities. The NBÚ maintains bilateral cybersecurity cooperation agreements and memoranda with international partners including AmCham Slovakia (2026), IT Association of Slovakia (2025), Rwanda (2025), Gambia (2025), Brazil (2025), the European Space Agency (2024), Kenya (2026), Indonesia (2023), Czechia (2023) and Romania (2017).
Sources: https://www.nbu.gov.sk/international-collaboration/
https://www.nbu.gov.sk/medzinarodna-spolupraca/
International Cyber Exercises and Operational Cooperation Initiatives: Slovakia participates in international cybersecurity exercises and operational cooperation initiatives including BlueOLEX, CySOPEx, Cyber Europe, NATO CMX, Cyber Coalition and Locked Shields. NBÚ and SK-CERT also participate in the Global Community of Practice on Coordinated Vulnerability Disclosure (CVD-COP) and the International Counter Ransomware Initiative (CRI), supporting operational cooperation, preparedness and coordinated responses to cyber threats.
Sources: https://www.nbu.gov.sk/international-collaboration/
https://www.nbu.gov.sk/medzinarodna-spolupraca/
International Cybersecurity Cooperation Function: URSIV serves as Slovenia's national contact point for international cybersecurity cooperation. It coordinates bilateral and multilateral cooperation, cyber diplomacy activities, engagement with EU institutions, NATO, ENISA, OSCE and the United Nations, and leads interministerial coordination on international cybersecurity policy.
EU Cybersecurity Cooperation: URSIV serves as Slovenia's Single Point of Contact for cross border cybersecurity cooperation within the European Union. Through this role, Slovenia participates in EU cybersecurity cooperation mechanisms, including collaboration with Member States, the CSIRT Network and the European Cyber Crisis Liaison Organisation Network (EU-CyCLONe). These mechanisms support information sharing, operational coordination and joint response activities for cybersecurity incidents and cyber crises affecting the EU
Sources: https://www.gov.si/en/state-authorities/government-offices/government-information-security-office/
National Cybersecurity Coordination Centre (NCC-SI) Participation in European Networks: NCC-SI acts as the Slovenian national coordination centre for cybersecurity under Regulation (EU) 2021/887 and participates in the European Network of National Coordination Centres while cooperating with the European Cybersecurity Competence Centre (ECCC).
Sources: https://ncc.si/
Western Balkans Cyber Capacity Centre (WB3C): Slovenia actively supports and helps deliver regional cybersecurity capacity-building activities through WB3C. Activities include training for CISOs, workshops for women in cybersecurity, cyber resilience programmes and conferences involving Western Balkan countries and international organisations.
Cooperation with ENISA: URSIV collaborates with the EU Agency for Cybersecurity (ENISA) and serves as the national contact point for ENISA-supported activities and projects aimed at improving cybersecurity resilience and regulatory implementation.
EU cybersecurity cooperation: INCIBE-CERT and CCN-CERT participate in European cybersecurity cooperation frameworks and networks (including the EU CSIRTs Network and EU-CyCLONe) to enhance cross-border operational incident response, threat intelligence sharing, and cyber crisis management.
Sources: https://www.enisa.europa.eu/topics/eu-incident-response-and-cyber-crisis-management/csirts-network
https://www.ccn-cert.cni.es/en/home.html
https://www.incibe.es/en/incibe-cert/publications/guides-and-studies/guides/spanish-national-guidelines-reporting-and-managing-cyber-incidents
INCIBE–OAS international cyber-capacity building: INCIBE and the Organization of American States (OAS) co-organise International CyberEx, a multinational technical exercise for national CSIRTs and cybersecurity specialists. INCIBE provides the exercise platform and infrastructure and invites participating CSIRTs, while teams test incident-response skills and cross-border coordination through realistic Capture-the-Flag challenges.
Sources: https://www.incibe.es/en/events/international-cyberex
https://www.incibe.es/en/incibe/press-room/eighth-edition-international-cyberex-25-will-be-taking-place
CCN Partnership in Ibero-America: The CCN engages in initiatives with several Ibero-American nations pertaining to both professional training and the deployment of Security Operations Centers (SOCs) within the region, facilitating the exchange of cyber threat intelligence and enhancing shared operational capabilities.
International cooperation in the field of cybersecurity: This pillar, through its action lines 4.1,4.2, and 4.3, enhance of international cooperation in the field of cybersecurity through the signing of agreements, the conduct of cyber exercises, and participation in forums, organizations, and agencies.
National Cybersecurity Centre and CERT-SE International Cooperation: The National Cybersecurity Centre (NCSC-SE) acts as a national platform for cooperation and information exchange between Swedish authorities, private stakeholders and international partners. CERT-SE, Sweden’s national CSIRT and part of NCSC-SE, serves as Sweden’s contact point for corresponding incident-response functions in other countries and supports international information exchange and coordinated incident handling. This cooperation includes participation in the EU CSIRTs Network and other international forums, including FIRST, TF-CSIRT/Trusted Introducer and the European Government CERTs group.
Sources: https://www.ncsc.se/
https://www.ncsc.se/sv/cybersakerhet/cert-se/
National Coordination Centre for Cybersecurity Research and Innovation (NCC-SE): NCC-SE serves as Sweden's interface with the European Cybersecurity Competence Community and the European Cybersecurity Competence Centre (ECCC). It promotes and supports the participation of Swedish universities, companies, research institutes and public authorities in European cybersecurity research, innovation and capacity-building projects, facilitating cross-border cooperation, knowledge exchange and engagement with European partners.
Sources: https://www.ncc-se.se/en/
Cybernoden (Cyber Node) International Collaboration Activities: Cybernoden facilitates cooperation between Swedish and international cybersecurity stakeholders. The platform supports participation in European projects, consortium building, international networking and cooperation on cybersecurity research and innovation.
Sources: https://cybernode.se/en/home/
Stay updated with ENISA! Sign up for email alerts on publications, events, vacancies, and more.