National Cybersecurity Governance

The cyber security strategy will succeed only if a clear governance framework is in place. A governance framework defines the roles, responsibilities and accountability of all relevant stakeholders. It provides a framework to achieve the objectives and priorities of the strategy and related polices, as well as the effectiveness of the implemented cybersecurity measures, with particular attention to those related to important and essential entities. This framework also offers dialogue and coordination of various activities undertaken in the lifecycle of the strategy, also underpinning the cooperation and coordination at the national level between the competent authorities, the single points of contact, and the CSIRTs under NIS2 Directive, as well as coordination and cooperation between those bodies and competent authorities under sector-specific Union legal acts. In particular, it should include enhanced coordination with the competent authorities under Directive (EU) 2022/2557 for the purpose of information sharing on risks, cyber threats, and incidents as well as on non-cyber risks, threats and incidents and the exercise of supervisory tasks, as well as performing an assessment on the level of capabilities including the available, financial, technical and human resources, and the effectiveness of the exercise of the tasks of the competent authorities (including CSIRTs). A list of the various authorities and stakeholders involved in the implementation of the national cybersecurity strategy should be included.

Austria

Belgium

Bulgaria

Croatia

Cyprus

Czech Republic

Denmark

Estonia

Finland

France

Germany

Greece

Hungary

Iceland

Ireland

Italy

Latvia

Liechtenstein

Lithuania

Luxembourg

Malta

Netherlands

Norway

Poland

Portugal

Romania

Slovakia

Slovenia

Spain

Sweden

Switzerland

Belgium

CCB statutory national governance and coordination role: The Centre for Cybersecurity Belgium (CCB) operates as Belgium’s national cybersecurity authority and national CSIRT. aAs national authority for cybersecurity, the CCB is responsible for: monitoring, coordinating and supervising the implementation of cybersecurity policy in Belgium; managing various projects in the field of cybersecurity from an integrated and centralised approach; ensuring coordination between the services and authorities concerned, and between public authorities and private academics sectors.

Sources: https://ccb.belgium.be/regulation/nis2
https://ccb.belgium.be/organisation/collaborations/national-coordination

National Cybersecurity Council and implementation-monitoring roadmap: The National Cybersecurity Council Belgium brings together federal and regional public authorities that provide cybersecurity services, enabling coordinated information exchange on ongoing initiatives. Together with the dedicated Cybersecurity Platform of the Coordination Committee for Intelligence and Security, it supports regular monitoring of implementation progress and the proposal of new actions. The Council maintains an overview of cybersecurity projects (including budgets, target groups and implementation periods) to identify gaps, allocate resources and measure progress.

Sources: https://ccb.belgium.be/organisation/collaborations/national-coordination

Belgian Strategic Board (SB): The Belgian Strategic Board (SB) is a central consultation platform at working group level, where all relevant administrations of federal and federated entities and of the security services in Belgium come together within the framework of the European Cybersecurity Competence Centre and Network (ECCC) Regulation. On the one hand, to further coordinate investments in research & innovation and the application of digital technologies in the field of cybersecurity in Belgium. On the other hand, to define a strategic stance that can most benefit both cybersecurity and economic development in Belgium.

Sources: https://ccb.belgium.be/organisation/collaborations/national-coordination

Related objective Strengthen National Cybersecurity Governance

Country related resources:

Action Plan

National cyber-crisis response plan

NIS2 notification guidance

Documents

BE_NCSS_2021_en.pdf

BE_NCSS_2021_fr.pdf

BE_NCSS_2021_de.pdf

BE_NCSS_2021_nl.pdf

BE_POLICY_DOCUMENT_2024_en.pdf

CCB_CyFun2023_Booklet-SMALL_E [LR-web].pdf

Croatia

Central government authority (NCSC-HR/SOA), competent authorities & CSIRT system: Croatia's operational governance architecture under the Cybersecurity Act (NN 14/24). It creates a central government authority for cybersecurity, whose tasks are performed by the National Cyber Security Centre (NCSC-HR), established within the Security and Intelligence Agency (SOA) in 2024 (transforming SOA's 2019 Cyber Security Centre). NCSC-HR is the central authority, government CERT, competent authority for most NIS2 sectors, cyber-crisis-management authority, single point of contact, and coordinator of all Croatian CSIRTs.

Sources: https://ncsc.hr/hr/o-nama
https://ncsc.hr/en/about-us
https://soa.hr/hr/soa-postala-sredisnje-drzavno-tijelo-za-kiberneticku-sigurnost/158
https://soa.hr/en/soa-became-the-national-cybersecurity-authority/158

National Cyber Security Strategy: The strategic-governance document setting national cyber priorities, values to protect, competent institutions and coordination mechanisms, with an accompanying Action Plan. Croatia's current Strategy (NN 108/15) was among the earlier EU national cyber strategies; an official English translation and summary are published. The Cybersecurity Act (2024) establishes a renewed strategic-planning and decision-making framework, and a new National Cyber Security Strategy is in preparation to reflect the NIS2 governance model.

Sources: https://www.uvns.hr/hr/o-nama/djelokrug/kiberneticka-sigurnost-1557
https://www.uvns.hr/en/legislation/information-security-290
https://mup.gov.hr/kiberneticka-sigurnost-282129/282129
https://mup.gov.hr/eu-and-ministry/cyber-security/163
https://ncsc.hr/UserDocsImages/ostalo/Cybersecurity_Act.pdf?vel=1434556

Related objective Strengthen National Cybersecurity Governance

Country related resources:

Action Plan

HR_ACTION_PLAN_2015_en.pdf

HR_ACTION_PLAN_2023_hr.pdf

Link

Documents

HR_NCSS_2015_hr.pdf

HR_NCSS_2015_en.pdf

HR_ANNUAL_REPORT_2023_hr.pdf

HR_SECURITY_STRATEGY_2017_en.pdf

Denmark

Danish Resilience Agency (SAMSIK): SAMSIK acts as the central national authority coordinating cybersecurity governance, NIS2 implementation, supervision, guidance and regulatory activities across sectors. It operates supervisory functions for multiple sectors and serves as the central coordination point for the Danish NIS2 framework.

Sources: https://samsik.dk/nis2/overview-of-competent-authorities/

Designation of Competent Authorities under the NIS2 Act: Regulation under the Danish NIS2 Act that designates the authorities responsible for supervising entities under the law and specifies the digital communication arrangements between entities and those authorities.

Sources: https://www.retsinformation.dk/eli/lta/2025/620

Danish National Coordination Centre for Cyber Security (NCC-DK): The purpose of the Danish National Coordination Centre for Cyber Security (NCC-DK) is to strengthen the Danish cyber security sector, increase the Danish take-home of cyber security funds from the EU and support the development and use of innovative cyber security solutions.

Sources: https://ncc-dk.dk/om-os/formaal/

The Cyber Security Council: The Cyber Security Council advises the government on how to strengthen digital security and contribute to knowledge sharing between authorities, the business community and the research community. The council also offers to develop cyber security skills.

Sources: https://samsik.dk/cybersikkerhed/cybersikkerhedsraadet/

Related objective Strengthen National Cybersecurity Governance

Estonia

Cyber Security Council (KJN) & Cyberpolicy Board: The KJN coordinates national cybersecurity policy across ministries and monitors the implementation of the national strategy. In practice, the Cyberpolicy Board brings government, business and research representatives into the policy process, while regular briefings keep the Government informed. Operational responsibilities are assigned to RIA and the ministries responsible for foreign affairs, defence, internal security and digital affairs. This structure links strategic oversight, stakeholder input and operational accountability, while a possible consolidated cyber agency remains under consideration.

Sources: https://www.justdigi.ee/en/digital-communications-and-cyber/ensuring-states-cyber-security

National Cyber Management Centre development: Estonia is developing a national cyber-management and government security-operations capability to improve central visibility, real-time monitoring, analysis and coordinated response across government systems. Work in 2026 includes defining the vision and service scope, assessing central and federated operating models, conducting market research on service capabilities and pricing, mapping costs and benefits, and engaging RIA, RIT and other stakeholders. The initiative builds on RIA's operations centre and is intended to strengthen national situational awareness and support sectoral and international cooperation.

Sources: What to expect in cyberspace in 2026 – RIA
National Cyber Security Centre – RIA

Related objective Strengthen National Cybersecurity Governance

Country related resources:

Action Plan

Digital Agenda 2030 and action plan

Digiühiskonna programm 2025 2028 (EELNÕU) [Digital Society Programme 2025–2028]

Digiühiskonna 2024. aasta tulemusaruanne [Digital Society 2024 Results Report] …

Digiühiskonna programm 2024 2029 [Digital Society Programme 2026–2029] — succes…

Cyber Security in Estonia 2025 (RIA Yearbook)

Documents

EE_NCSS_2024_en.pdf

EE_NCSS_2024_et.pdf

EE_NCSS_2024_doc_et.pdf

EE_REPORT_ON_CYBER_SECURITY_2024_en.pdf

Cyber-security-in-Estonia-2026.pdf

Finland

Distributed governance and the Security Committee: Finland's cyber-security governance is based on distributed ministerial responsibility within the comprehensive-security model, coordinated by the Security Committee, with the NCSC-FI providing the operational and situational-awareness backbone. Responsibilities and powers are grounded in legislation, and authorities cooperate through well-established coordination groups.

Sources: https://turvallisuuskomitea.fi/en/security-strategy-for-society/

The Office of the National Cyber Security Director coordinates and harmonises national cybersecurity development, planning and preparedness: First appointed in 2020 and later made a permanent post, the National Cyber Security Director advises the state leadership and brings together cyber-security actors and interprets the situation picture for decision-makers; the role does not alter the existing responsibilities and powers of the ministries and competent authorities.

Sources: https://lvm.fi/en/-/national-cyber-security-director-appointed-1033628
Liikenne- ja viestintäministeriön asetus liikenne- ja viestintäministeriön työjärjestyksestä | 470/2023 | Lainsäädäntö | Finlex (available in FI and SWE only)

Cyber Security Strategy 2024-2035 and implementation plan: Finland's Cyber Security Strategy was revised by Government Resolution of 10 October 2024, extending its objectives to 2035 and integrating cyber security into comprehensive security. An implementation plan approved on 3 December 2024 sets out the measures, responsibilities and metrics; implementation is linked to general government fiscal planning, and the Office of the National Cyber Security Director coordinates annual monitoring.

Sources: https://valtioneuvosto.fi/en/-/1410829/cyber-security-strategy-implementation-plan-published-cybersecurity-integrated-into-comprehensive-security

Related objective Strengthen National Cybersecurity Governance

Germany

BSI as national cybersecurity authority (BSI Act): The BSI is Germany's central federal authority for information security, established by the BSI Act. It sets security standards, supervises regulated entities, operates the national CERT and situation centre, and acts as the national competent authority and single point of contact under the NIS-2 framework, anchoring national cybersecurity governance.

Sources: https://www.bsi.bund.de/DE/Das-BSI/das-bsi_node.html
https://www.bsi.bund.de/EN/Das-BSI/das-bsi_node.html

National Cyber Defence Centre (Nationales Cyber-Abwehrzentrum - Cyber-AZ): The central operational and inter-agency cooperation and coordination platform established to prevent, monitor, and analyse cyber-incidents. It links the BSI, intelligence agencies, federal law enforcement, civil defense and partners (e. g. from states). It creates a shared situational picture and enables rapid, coordinated action against threats.

Sources: https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Reaktion/Nationales-IT-Lagezentrum/Nationales-Cyber-Abwehrzentrum/nationales-cyber-abwehrzentrum_node.html

Related objective Strengthen National Cybersecurity Governance

Greece

The National Cybersecurity Authority (NCSA): The National Cybersecurity Authority (NCSA) of Greece aims to organise, coordinate and implement a comprehensive framework of strategies, measures and actions for achieving and maintaining a high level of prevention, protection, deterrence, response and recovery from cyberattacks. To fulfill its purpose, the Authority develops comprehensive cybersecurity policies framework and draws the National Cybersecurity Strategy (NCSS) through which the strategic objectives, the priorities and the cybersecurity governance framework are defined. At the national level, NCSA is the leading authority in the cybersecurity domain implementing a whole of government approach. The Authority is responsible for issuing mandatory cybersecurity requirements for essential and important entities, as well as guidance of implementation and it is the competent authority to monitor compliance with the cybersecurity legislation. It fosters cooperation and coordination between governmental agencies and between the public and private sector. The Authority cooperates with EU agencies, other member states’ entities and communicates and exchanges expertise with international bodies and organisations as well as allied countries.

Sources: https://cyber.gov.gr/en/

Ministerial Oversight through the Ministry of Digital Governance: The National Cybersecurity Authority operates under the supervision of the Ministry of Digital Governance, which provides institutional oversight of national cybersecurity policy implementation and governance arrangements.

Sources: https://www.gov.gr/en/organizations/ministries/upourgeio-psephiakes-diakuberneses

Related objective Strengthen National Cybersecurity Governance

Hungary

Cybersecurity Commissioner, National Cybersecurity Working Group (NKM) and Operational Task Force: Hungary's top strategic-governance layer under the Cybersecurity Act (Act LXIX of 2024). The Cybersecurity Commissioner (appointed by the minister responsible for IT) leads the National Cybersecurity Working Group (NKM), an inter-governmental body that is the government's advisory and consultative body on cybersecurity, coordinates the activities defined in law, and must be consulted before any cybersecurity legislation is amended or introduced. It replaced the former National Cybersecurity Coordination Council (2013). The NKM is supported by sub-working groups (National Cyberspace; "NIS2 in public administration"; Strategic; and an International/EU group led by the Ministry of Foreign Affairs and Trade) and an Operational Task Force empowered to escalate a large-scale incident and declare a cyber crisis.

Sources: https://nbsz.gov.hu/
https://nki.gov.hu/intezet/tartalom/magunkrol/
https://njt.jog.gov.hu/jogszabaly/en/2024-69-00-00

Central authority - National Cyber Security Centre of Hungary (NCSC HU), four-authority supervisory model and CSIRT: Hungary's operational governance architecture is anchored by the National Cyber Security Centre of Hungary (NCSC HU). Operating within the Special Service for National Security (SSNS) under the Cabinet Office of the Prime Minister, it serves as the central cybersecurity authority, the national CSIRT and the single point of contact. Sectoral cyber supervision is split across four authorities: NCSC HU supervises public administration and majority state-owned/critical bodies; SZTFH Supervisory Authority of Regulated Activities) supervises other economic operators; the MNB (National Bank of Hungary) supervises the financial sector; and the Ministry of Defence supervises the defence sector. This distributes registration, supervision, incident handling and enforcement across the state.

Sources: https://en.nki.gov.hu/authority/competence/
https://sztfh.hu/tevekenysegek/kiberbiztonsagi-tanusitasok/kiberbiztonsagi-felugyelet/
https://njt.jog.gov.hu/jogszabaly/2024-418-20-22

Related objective Strengthen National Cybersecurity Governance

Liechtenstein

National Cyber Security Unit: The National Cyber Security Unit is Liechtenstein’s central point of contact for matters relating to cyber risks. It acts as a hub, mediation and liaison point for the population, the economy, critical infrastructures and state authorities. The Unit receives information and incident notifications, uses them to produce situational pictures and identify possible correlations, and may initiate measures or issue warnings based on the information received.

Sources: https://www.llv.li/en/national-administration/national-cyber-security-unit
https://www.llv.li/de/landesverwaltung/stabsstelle-cybersicherheit

Cyber Security Law (CSG): The Cyber Security Law establishes cybersecurity risk-management obligations for essential and important entities and requires the implementation of appropriate and proportionate technical, operational and organisational measures to manage risks affecting network and information systems. The law forms the national legal framework for cybersecurity risk management and resilience.

Sources: https://www.regierung.li/files/attachments/2025111000-csg-en.pdf
https://www.gesetze.li/konso/2025111000

Related objective Strengthen National Cybersecurity Governance

Country related resources:

Action Plan

Measures for Implementing the National Cyber Security Strategy 2025

Documents

LI_NCSS_2025_de.pdf

LI_NCSS_2025_en.pdf

LI_CYBER_SECURITY_ACT_2025_de.pdf

LI_CYBER_SECURITY_REGULATION_2025_de.pdf

LI_CYBER_SECURITY_REGULATION_2025_en.pdf

LI CYBERSECURITY LAW 2025 EN_0.pdf

Malta

National Cyber Security Steering Committee: The National Cyber Security Steering Committee oversees implementation of Malta's National Cyber Security Strategy, ensures that the strategy remains current and acts as the national reference point for cybersecurity governance.

Sources: https://www.gov.mt/en/Government/Government%20of%20Malta/Ministries%20and%20Entities/Officially%20Appointed%20Bodies/Pages/Committees/National-Cyber-Security-Strategy-Steering-Committee.aspx
https://www.gov.mt/mt/Government/Government%20of%20Malta/Ministries%20and%20Entities/Officially%20Appointed%20Bodies/Pages/Committees/National-Cyber-Security-Strategy-Steering-Committee.aspx

Critical Infrastructure Protection Directorate (CIPD): Critical Infrastructure Protection Directorate (CIPD) is Malta's competent authority for critical infrastructure protection and cybersecurity supervision. The Department coordinates national implementation of cybersecurity obligations, oversees designated entities and supports national resilience and protection activities.

Sources: https://maltacip.gov.mt/en/
https://maltacip.gov.mt/

National Cyber Security Coordination Centre (NCC-MT): With the launch of Regulation (EU) 2021/887 that saw the creation of the European Cybersecurity Industrial, Technology, and Research Competence Centre (ECCC), National Coordination Centres (NCCs) have been set up in each Member State to support cybersecurity capacity building. The aim is for NCCs to build the necessary capacity at a national level, but also internationally through cross-border cooperation and joint actions. Locally, Malta has prioritised this regulation and identified MITA to be the National Coordination Centre within Maltese territory. Following this mandate, a dedicated NCC-MT team within MITA’s Cyber Security Department (CSD) was formed.

Sources: https://ncc-mita.gov.mt/about-us/

Measures for a High Common Level of Cybersecurity Across the European Union (Malta) Order (S.L. 460.41): Malta's NIS2 framework establishes the national cybersecurity governance and supervisory structure, including competent authorities, supervisory responsibilities, cybersecurity obligations, enforcement powers and cooperation mechanisms. The framework provides the legal basis for national cybersecurity governance and oversight of essential and important entities.

Sources: https://legislation.mt/eli/sl/460.41/eng
https://legislation.mt/eli/sl/460.41/20260407/mlt
https://www.enisa.europa.eu/sites/default/files/ncss-map/strategies/national-implementation/S.L.%20460.41.pdf

GMICT Policy Framework: MITA is mandated to maintain the Government of Malta ICT policies, collectively referred to as the GMICT policy framework. The policies apply to the whole of the Public Administration and evolve according to changing business requirements so that they work together as a consistent whole. The framework includes the Information Security Policy, the Vulnerability Disclosure Policy, the Cloud Services Policy, the Electronic Mail Policy, the Internet Policy, the Workstation Policy, the Enterprise Architecture Policy for Interoperability and Reuse, and a policy on the usage of Generative Artificial Intelligence tools.

Sources: https://mita.gov.mt/portfolio/gmict-policies/

Related objective Strengthen National Cybersecurity Governance

Netherlands

NCTV strategic coordination of national cybersecurity policy: NCTV coordinates national cybersecurity policy and the implementation framework for the Netherlands Cybersecurity Strategy. It aligns ministries and national-security partners and connects cyber policy with broader crisis and security governance. Its role is to keep the system aligned while specialist bodies retain their own mandates.

Source: https://www.nctv.nl/onderwerpen/n/nederlandse-cybersecuritystrategie-2022-2028

NCSC-NL national cybersecurity authority, expertise centre and CSIRT: NCSC-NL brings national CSIRT, expertise and information-coordination functions together in one public authority. Its consolidation with CSIRT-DSP and the Digital Trust Center reduces fragmentation and gives government and organisations a clearer national contact point. For users, the consolidation means fewer institutional hand-offs and a clearer route into national support.

Source: https://www.ncsc.nl/over-ons/versterkt-ncsc

Cyber Security Council (CSR) strategic advice: The Cyber Security Council brings senior representatives from government, business and academia into national cybersecurity governance. It provides independent strategic advice to the Cabinet on resilience, skills, governance and public-private cooperation. Its value is challenge and outside perspective, not direct control of operations.

Source: https://www.cybersecurityraad.nl/
https://www.nctv.nl/site/binaries/site-content/collections/documents/2022/10/10/nederlandse-cybersecuritystrategie-2022-2028/Nederlandse+Cybersecuritystrategie+2022-2028.pdf

Cbw duty of care (zorgplicht) and NCSC baseline guidance: The Cyber Security Act imposes a statutory duty of care: entities in scope must take appropriate technical and organisational measures to manage cyber risks, prevent incidents and limit their impact, including supply-chain risks. Management bodies must approve and be trained on these measures and can be held personally liable. The strengthened NCSC-NL provides the practical baseline (basismaatregelen / digital basic principles), scans and tools that organisations use to implement the duty of care.

Source: https://www.ncsc.nl/over-ons/versterkt-ncsc, https://www.ncsc.nl/cyberbeveiligingswet-nis2

Related objective Strengthen National Cybersecurity Governance

Poland

National governance under the amended KSC Act: The amended Act on the National Cybersecurity System allocates national cybersecurity responsibilities among the Ministry of Digital Affairs, the Government Plenipotentiary for Cybersecurity, competent sectoral authorities and national-level CSIRTs. These institutions operate the registration, coordination, supervision, incident-reporting and response mechanisms through which national cybersecurity governance is implemented.

Sources: https://www.gov.pl/web/baza-wiedzy/nowelizacja-ustawy-o-krajowym-systemie-cyberbezpieczenstwa

College for Cybersecurity and Government Plenipotentiary coordination: The College for Cybersecurity provides inter-institutional advice on national cybersecurity priorities. The Government Plenipotentiary coordinates government policy, may issue recommendations and links strategic decisions with implementation across ministries, competent authorities and KSC bodies.

Sources: https://www.gov.pl/web/cyfryzacja/pelnomocnik-rzadu-do-spraw-cyberbezpieczenstwa

Amended KSC Act governance and supervisory framework: The amended Act on the National Cybersecurity System is the central statutory basis for governance, risk management, incident reporting, supervision and enforcement. It defines covered entities, competent authorities, national-level CSIRTs and the mechanisms through which cybersecurity obligations are implemented and monitored.

Sources: https://www.gov.pl/web/baza-wiedzy/nowelizacja-ustawy-o-krajowym-systemie-cyberbezpieczenstwa

Related objective Strengthen National Cybersecurity Governance

Portugal

National Cybersecurity Centre (CNCS): The National Cybersecurity Centre (CNCS) acts as Portugal's national cybersecurity authority, operational coordinator and national point of contact for cybersecurity matters. Under the Cybersecurity Legal Framework, CNCS is responsible for regulation, supervision, cybersecurity certification, incident coordination, guidance and cooperation with European institutions and Member States.

Sources: https://www.cncs.gov.pt/en/about-us/
https://www.cncs.gov.pt/pt/sobre-nos/#missao

High Council for Cyberspace Security (CSSC): Consultative body to the Prime Minister in the field of cybersecurity, forming part of the institutional cybersecurity framework established under Article 15 of Decree-Law No. 125/2025.

Sources: https://www.cncs.gov.pt/pt/diretiva-nis-2/
https://files.diariodarepublica.pt/1s/2025/12/23400/0000400068.pdf

Secretary-General of the Internal Security System (SG-SSI): National authority responsible for the management of large-scale cybersecurity crises and incidents under Article 15 of Decree-Law No. 125/2025.

Sources: https://www.cncs.gov.pt/pt/diretiva-nis-2/
https://files.diariodarepublica.pt/1s/2025/12/23400/0000400068.pdf

National Security Office (GNS): National sectoral cybersecurity authority responsible for trust services used in electronic transactions within the internal market.

Sources: https://www.cncs.gov.pt/pt/diretiva-nis-2/
https://files.diariodarepublica.pt/1s/2025/12/23400/0000400068.pdf

National Communications Authority (ANACOM): National sectoral cybersecurity authority responsible for electronic communications and postal services.

Sources: https://www.cncs.gov.pt/pt/diretiva-nis-2/
https://files.diariodarepublica.pt/1s/2025/12/23400/0000400068.pdf

Related objective Strengthen National Cybersecurity Governance

Country related resources:

Action Plan

PT_REPORT_ON_ACTION_PLAN_2020_pt.pdf

Action Plan Details

Documents

PT_NCSS_2019_en.pdf

PT_NCSS_2019_pt.pdf

PT_NCSS_IMPLEMENTATION_REPORT_2019_pt.pdf

PT_NCSS_OFFICIAL_DOCUMENT_2019_pt.pdf

PT_NCSS_IMPLEMENTATION_REPORT_2020_pt.pdf

PT_NCSS_IMPLEMENTATION_REPORT_2022_pt.pdf

Slovakia

National Security Authority (Národný bezpečnostný úrad, NBÚ): The National Security Authority is Slovakia's central cybersecurity authority. Under the National Cybersecurity Act. NBÚ coordinates national cybersecurity governance, develops policies and methodologies, supervises regulated entities, acts as the national point of contact, oversees national cybersecurity implementation and performs national cybersecurity certification functions.

Sources: https://www.nbu.gov.sk/o-urade/

National Cybersecurity Coordination Centre (NCC-SK): Slovakia has established a National Coordination Centre for Cybersecurity under the European Cybersecurity Competence Centre framework. The centre supports national cybersecurity capacity-building, cooperation, stakeholder engagement, certification activities, education, research and participation in European cybersecurity initiatives.

Sources: https://www.kyberkomunita.sk/

National Cybersecurity Act (Act No. 69/2018 Coll., as amended by Act No. 366/2024 Coll.): Slovakia's Cybersecurity Act and its NIS2 transposition amendment establish the national cybersecurity governance and supervisory framework. The legislation defines competent authorities, supervisory responsibilities, governance structures, cybersecurity obligations, enforcement powers, certification responsibilities, registration requirements and cooperation mechanisms.

Sources: https://www.ujd.gov.sk/wp-content/uploads/2025/01/ZZ_2024_366-1.pdf

Related objective Strengthen National Cybersecurity Governance

Slovenia

Designation of URSIV as National Cybersecurity Authority: URSIV serves as Slovenia's competent national authority for information and cybersecurity. It coordinates the national cybersecurity system, provides guidance and supervision, supports regulated entities, develops policies and coordinates operational cybersecurity capabilities at the strategic level.

Sources: https://www.gov.si/en/state-authorities/government-offices/government-information-security-office/about-the-office/

National Coordination Centre for Cybersecurity (NCC-SI): NCC-SI serves as the national coordination centre and a key governance mechanism connecting government, industry, academia and research stakeholders. It supports strategic planning, capacity building, innovation, awareness activities and implementation of European cybersecurity initiatives.

Sources: https://ncc.si/

https://www.gov.si/en/state-authorities/government-offices/government-information-security-office/about-the-office/national-cybersecurity-coordination-center/

Cyber Crisis Management and National Security Integration: URSIV is designated as the competent authority for managing large-scale cyber incidents and cyber crises and participates in EU-CyCLONe. It also informs the Government and the National Security Council about significant cyber threats and incidents, integrating cybersecurity into the national security system.

Sources: https://www.gov.si/en/state-authorities/government-offices/government-information-security-office/about-the-office/

Single Point of Contact and International Governance Role: URSIV acts as Slovenia's single point of contact for cybersecurity cooperation and represents Slovenia in governance and policy bodies of the European Union, ENISA, NATO and other international organisations.

Sources: https://www.gov.si/en/state-authorities/government-offices/government-information-security-office/about-the-office/

https://www.gov.si/en/state-authorities/government-offices/government-information-security-office/about-the-office/international-affairs-and-public-relations-division/

SECIS Programme for Ecosystem Governance: The SECIS project strengthens NCC-SI as a central hub for knowledge, cooperation, capacity building and stakeholder coordination. It includes development of stakeholder registries, digital platforms, financing mechanisms and coordinated governance support for cybersecurity actors.

Sources: https://www.gov.si/zbirke/projekti-in-programi/krepitev-ekosistema-kibernetske-varnosti-v-sloveniji-secis/

Related objective Strengthen National Cybersecurity Governance

Country related resources:

Action Plan

SI_DIGITAL_SLOVENIA_action_plan_si.pdf

https://www.gov.si/assets/ministrstva/MDP/DDD/DDD-dokumenti/Akcijski-nacrt-stra…

Documents

SI_NCSS_2016_en.pdf

SI_NCSS_2016_si.pdf

SI_SECURITY_STRATEGY_2019_en.pdf

SI_DIGITAL_SLOVENIA_2030_en.pdf

SI_DIGITAL_SLOVENIA_2030_si.pdf

SI_INTERNATIONAL ENGAGEMENT STRATEGY_si.pdf

Spain

National cybersecurity governance through the National Security System: Spain’s cybersecurity governance is embedded in the National Security System through the National Security Council, the National Cybersecurity Council and the Department of National Security. Under the 2019 strategy, these bodies set direction, assess risk, monitor implementation and coordinate action across public authorities and relevant private stakeholders.

Sources: https://www.dsn.gob.es/es/estructuras-de-seguridad-nacional/comites-especializados/consejo-nacional-de-ciberseguridad
https://www.dsn.gob.es/sites/default/files/2025-04/Estrategia%20Nacional%20de%20Ciberseguridad%202019%20-%20%20Interactivo_0%20(1

Related objective Strengthen National Cybersecurity Governance

Country related resources:

Action Plan

ES_Complementary actions to the National Cybersecurity Plan_es.pdf

ES_Modification of the 2025 complementary actions_es.pdf

National Cybersecurity Plan Announcement

Complementary actions to the National Cybersecurity Plan

Modification of the 2025 complementary actions

National Security Scheme, Royal Decree 311/2022

Documents

ES_NCSS_2019_en.pdf

ES_NCSS_2019_es.pdf

ES_National Security Strategy 2021_es.pdf

ES_Procedure for a new National Cybersecurity Strategy_es.pdf

Sweden

National Cybersecurity Centre (Nationellt cybersäkerhetscenter, NCSC-SE): The National Cybersecurity Centre serves as the central national coordination body for cybersecurity. It supports cooperation among public authorities and private stakeholders, strengthens national cyber resilience and acts as a national focal point for cybersecurity governance and coordination.

Sources: https://www.ncsc.se/

Annual Action Plan and Follow-Up Mechanism: Sweden's cybersecurity governance framework includes an action plan attached to the National Cybersecurity Strategy. The action plan is updated regularly and assigns activities to responsible organisations, creating a structured governance and monitoring mechanism.

Sources: https://www.regeringen.se/contentassets/a35c523611834fa1997d1ff5b2297338/bilaga-1-handlingsplan.pdf
https://www.regeringen.se/informationsmaterial/2025/03/nationell-strategi-for-cybersakerhet-2025-2029/

National Roles and Responsibilities Framework: Sweden has formally defined cybersecurity roles and responsibilities across relevant authorities and organisations. The framework clarifies governance responsibilities and supports coordination across the cybersecurity ecosystem.

Sources: https://www.regeringen.se/contentassets/a35c523611834fa1997d1ff5b2297338/bilaga-2-organisationer-med-roller-och-ansvar.pdf
https://www.regeringen.se/informationsmaterial/2025/03/nationell-strategi-for-cybersakerhet-2025-2029/

Related objective Strengthen National Cybersecurity Governance

National Cybersecurity Governance

National Cybersecurity Governance

Country related resources:

Country related resources:

Country related resources:

Country related resources:

Country related resources:

Country related resources:

Country related resources:

Country related resources:

Country related resources:

Country related resources:

Country related resources:

Country related resources:

Country related resources:

Country related resources:

Country related resources:

Country related resources:

Country related resources:

Subscribe