About

Cybersecurity rules are never all in one place. A national strategy sits on the agency’s website, the decree that implements it is in the official gazette, the EU directive is on EUR-Lex, and the guidelines are in a PDF whose address changes every time the site hosting it is redesigned. Working out what applies in a country today, and since when, often means piecing it together by hand.

Cybersecurity Database exists to do that work once and make it available to everyone. It collects national strategies, laws, regulations, decrees, directives and guidelines on cybersecurity, from individual states and from international organisations. Each document has an entry with a short summary, its status (in force, repealed or superseded), the dates that matter and a link to the official text, which always remains the reference.

Beyond individual acts, the site follows the things that usually take the most effort: how far EU member states have got in transposing NIS 2 and the CER Directive, how incident reporting obligations differ from one country to another, and which deadlines are coming up. It is meant for people who have to apply, study or report on these rules: security managers, lawyers, public officials, researchers, journalists.

Who is behind it

The project was started and is maintained by Giovanni Corbò (see the Legal notice). It is independent: it sells no services, carries no advertising and is funded by its owner and by donations. You can also follow the project’s news on its LinkedIn page (opens in a new tab).

If something looks wrong

A collection like this is never complete, and the rules change often. If a document is missing, a date is wrong or a link no longer leads to the text, write from the Contact page or open a public report on GitHub (opens in a new tab). How we choose and check documents is explained in the Methodology. The entries can be freely reused under the CC BY 4.0 licence, from the Open data page.