National authorities compared
Who handles cybersecurity in each country: the national agency, the authorities that receive incident reports and, in EU Member States, the NIS 2 authorities and CSIRTs and those designated for the Cyber Resilience Act. The information comes from the database records, checked against official sources.
Data checked on 29 October 2026 against official sources. The text of the law always prevails. · Glossary
How to read the table
- Cybersecurity agency
- The public body that leads cybersecurity in the country
- Where to report an incident
- The body an affected organisation must notify of the attack, law by law
- Who supervises companies (NIS 2)
- Supervisory authorities and incident response teams (CSIRTs) under the NIS 2 Directive. EU Member States only
- Digital product security (CRA)
- Authorities that check software and connected devices sold in the EU. EU Member States only
“–” means no data for that country.
| Country | Cybersecurity agency | Where to report an incident | Who supervises companies (NIS 2) | Digital product security (CRA) |
|---|---|---|---|---|
| The public body that leads cybersecurity in the country | The body an affected organisation must notify of the attack, law by law | Supervisory authorities and incident response teams (CSIRTs) under the NIS 2 Directive. EU Member States only | Authorities that check software and connected devices sold in the EU. EU Member States only | |
| European UnionEuropean Union Agency for Cybersecurity (ENISA) | European Union Agency for Cybersecurity (ENISA) (opens in a new tab) |
| – | – |
| ArgentinaCentro Nacional de Ciberseguridad (CNC) | Centro Nacional de Ciberseguridad (CNC) (opens in a new tab) | – | – | – |
| AustraliaAustralian Signals Directorate – Australian Cyber Security Centre (ASD's ACSC) | Australian Signals Directorate – Australian Cyber Security Centre (ASD's ACSC) (opens in a new tab) |
| – | – |
| AustriaBundesamt für Cybersicherheit | Bundesamt für Cybersicherheit (opens in a new tab) | – | Competent authority and single point of contact: Federal Office for Cybersecurity (Bundesamt für Cybersicherheit), under the Ministry of the Interior. CSIRT: GovCERT Austria for public administration, which also acts as national CSIRT until the Office authorises one; CERT.at and Austrian HealthCERT are also members of the EU CSIRTs Network. → | Notifying authority: Federal Chancellery (Bundeskanzleramt). Market surveillance: to be designated. → |
| BahrainNational Cyber Security Center (NCSC) | National Cyber Security Center (NCSC) (opens in a new tab) | – | – | – |
| BangladeshNational Cyber Security Agency (জাতীয় সাইবার সুরক্ষা এজেন্সি) | National Cyber Security Agency (জাতীয় সাইবার সুরক্ষা এজেন্সি) | – | – | – |
| BelgiumCentre for Cybersecurity Belgium (CCB) | Centre for Cybersecurity Belgium (CCB) (opens in a new tab) | – | National authority, single point of contact and CSIRT: Centre for Cybersecurity Belgium (CCB); sectoral authorities take part in inspections in their sectors. → | – |
| BrazilGabinete de Segurança Institucional da Presidência da República (GSI/PR) | Gabinete de Segurança Institucional da Presidência da República (GSI/PR) (opens in a new tab) | – | – | – |
| Bulgaria | – | – | Competent authorities: designated sector by sector by the Council of Ministers; for administrative bodies, the Ministry of Innovation and Digital Transformation, which also hosts the single point of contact. CSIRT: the national team CERT Bulgaria, with sectoral CSIRTs at the competent authorities. → | – |
| CameroonAgence Nationale des Technologies de l'Information et de la Communication (ANTIC) | Agence Nationale des Technologies de l'Information et de la Communication (ANTIC) (opens in a new tab) | – | – | – |
| CanadaCanadian Centre for Cyber Security | Canadian Centre for Cyber Security (opens in a new tab) |
| – | – |
| ChileAgencia Nacional de Ciberseguridad (ANCI) | Agencia Nacional de Ciberseguridad (ANCI) (opens in a new tab) |
| – | – |
| ChinaCyberspace Administration of China (国家互联网信息办公室) | Cyberspace Administration of China (国家互联网信息办公室) (opens in a new tab) |
| – | – |
| ColombiaColCERT – Ministerio de Tecnologías de la Información y las Comunicaciones | ColCERT – Ministerio de Tecnologías de la Información y las Comunicaciones (opens in a new tab) | – | – | – |
| Costa RicaMinisterio de Ciencia, Innovación, Tecnología y Telecomunicaciones (MICITT) | Ministerio de Ciencia, Innovación, Tecnología y Telecomunicaciones (MICITT) (opens in a new tab) | – | – | – |
| Croatia | – | – | Central authority and single point of contact: Security and Intelligence Agency (SOA), through its National Cyber Security Centre. Other competent authorities: Office of the National Security Council, the network industries regulator (HAKOM), the body for the digital society and the Ministry of Science and Education. CSIRT: the SOA's (NCSC-HR) or CARNET's (CERT.hr), depending on the sector. → | – |
| CyprusDigital Security Authority (DSA) | Digital Security Authority (DSA) (opens in a new tab) | – | Competent authority and single point of contact: Digital Security Authority (DSA). CSIRT: CSIRT-CY, the national CSIRT within the Authority. → | Notifying authority and, in future, market surveillance: Digital Security Authority (within the Office of the Commissioner of Communications), according to the Commissioner. Reports: the Authority's national CSIRT. → |
| CzechiaNárodní úřad pro kybernetickou a informační bezpečnost (NÚKIB) | Národní úřad pro kybernetickou a informační bezpečnost (NÚKIB) (opens in a new tab) | – | Competent authority and single point of contact: National Cyber and Information Security Agency (NÚKIB). CSIRT: NÚKIB's GovCERT.CZ and CSIRT.CZ, the national CSIRT run by CZ.NIC. → | Notifying authority and reports: NÚKIB. Market surveillance: existing sectoral authorities (for example the Czech Trade Inspection Authority). → |
| DenmarkStyrelsen for Samfundssikkerhed (SAMSIK) | Styrelsen for Samfundssikkerhed (SAMSIK) (opens in a new tab) | – | Competent authorities: sectoral, including the Danish Agency for Societal Security (Styrelsen for Samfundssikkerhed), the Agency for Digital Government, the Energy Agency, the Health Data Authority, the Civil Aviation and Railway Authority and the Maritime Authority. CSIRT: the Danish Defence Intelligence Service (FE), formerly the Centre for Cyber Security (CFCS). → | Under the draft: notifying authority, market surveillance and national coordination by Styrelsen for Samfundssikkerhed (Danish Resilience Agency); the AI market surveillance authorities for products that are high-risk AI systems; DANAK assesses conformity assessment bodies. Reports: national CSIRT (Centre for Cyber Security). → |
| Dominican RepublicCentro Nacional de Ciberseguridad (CNCS) | Centro Nacional de Ciberseguridad (CNCS) (opens in a new tab) | – | – | – |
| EcuadorMinisterio de Telecomunicaciones y de la Sociedad de la Información (MINTEL) | Ministerio de Telecomunicaciones y de la Sociedad de la Información (MINTEL) (opens in a new tab) |
| – | – |
| EgyptEgyptian Computer Emergency Readiness Team (EG-CERT) | Egyptian Computer Emergency Readiness Team (EG-CERT) | – | – | – |
| El SalvadorAgencia de Ciberseguridad del Estado (ACE) | Agencia de Ciberseguridad del Estado (ACE) (opens in a new tab) | – | – | – |
| EstoniaRiigi Infosüsteemi Amet (RIA) | Riigi Infosüsteemi Amet (RIA) (opens in a new tab) | – | Competent authority and single point of contact: Information System Authority (RIA). CSIRT: CERT-EE, within RIA. → | – |
| FinlandKyberturvallisuuskeskus (Traficom NCSC-FI) | Kyberturvallisuuskeskus (Traficom NCSC-FI) (opens in a new tab) |
| Authorities: Transport and Communications Agency (Traficom), also the single point of contact, together with sectoral supervisory authorities. CSIRT: Traficom's National Cyber Security Centre (NCSC-FI). → | Market surveillance, notifying authority and reports: Traficom (National Cyber Security Centre NCSC-FI). → |
| FranceAgence nationale de la sécurité des systèmes d'information (ANSSI) | Agence nationale de la sécurité des systèmes d'information (ANSSI) (opens in a new tab) |
| Under the bill: national authority and single point of contact, the National Cybersecurity Agency (ANSSI); national CSIRT, ANSSI's CERT-FR. Pending transposition, ANSSI remains the NIS 1 authority. → | Notifying authority and CSIRT: ANSSI. Market surveillance: ANFR with ANSSI's technical support, according to the ministry (not yet set by an act). → |
| GermanyBundesamt für Sicherheit in der Informationstechnik (BSI) | Bundesamt für Sicherheit in der Informationstechnik (BSI) (opens in a new tab) |
| Competent authority and single point of contact: Federal Office for Information Security (BSI). CSIRT: BSI's CERT-Bund. → | Market surveillance, notifying authority and CSIRT for reports: Federal Office for Information Security (BSI). → |
| GhanaCyber Security Authority (CSA) | Cyber Security Authority (CSA) (opens in a new tab) |
| – | – |
| GreeceΕθνική Αρχή Κυβερνοασφάλειας | Εθνική Αρχή Κυβερνοασφάλειας (opens in a new tab) | – | Competent authority, single point of contact and CSIRT: National Cybersecurity Authority, through its EL-CSIRT. The Defence GR-CSIRT and NCERT-GR are also members of the EU CSIRTs Network. → | – |
| Hong KongOffice of the Commissioner of Critical Infrastructure (Computer-system Security) | Office of the Commissioner of Critical Infrastructure (Computer-system Security) (opens in a new tab) |
| – | – |
| HungaryNemzeti Kibervédelmi Intézet (NKI) | Nemzeti Kibervédelmi Intézet (NKI) (opens in a new tab) | – | Authorities: the Special Service for National Security (NBSZ), through its National Cyber Security Institute (NKI), as national authority; the Supervisory Authority for Regulated Activities (SZTFH) for the businesses listed in the Act; the Minister of Defence for defence. CSIRT: the NBSZ's national incident handling centre (NKI). → | Market surveillance and notifying authority: Supervisory Authority for Regulatory Affairs (SZTFH). → |
| IcelandCERT-IS | CERT-IS (opens in a new tab) | – | – | – |
| IndiaIndian Computer Emergency Response Team (CERT-In) | Indian Computer Emergency Response Team (CERT-In) (opens in a new tab) |
| – | – |
| IndonesiaBadan Siber dan Sandi Negara (BSSN) | Badan Siber dan Sandi Negara (BSSN) (opens in a new tab) | – | – | – |
| IrelandNational Cyber Security Centre (NCSC-IE) | National Cyber Security Centre (NCSC-IE) (opens in a new tab) | – | Today, under the 2018 NIS 1 Regulations, sectoral competent authorities and the National Cyber Security Centre (NCSC); the General Scheme would put the NCSC on a statutory footing as national CSIRT and single point of contact. CSIRT: CSIRT-IE, within the NCSC. → | Reports: National Cyber Security Centre (NCSC). Market surveillance and notifying authority: to be designated. → |
| IsraelIsrael National Cyber Directorate (INCD) | Israel National Cyber Directorate (INCD) (opens in a new tab) | – | – | – |
| ItalyAgenzia per la Cybersicurezza Nazionale (ACN) | Agenzia per la Cybersicurezza Nazionale (ACN) (opens in a new tab) |
| National competent authority and single point of contact: National Cybersecurity Agency (ACN), with the sectoral authorities named in the decree. CSIRT: CSIRT Italia, within ACN. → | Under the draft: notifying and market surveillance authority is the National Cybersecurity Agency (ACN), which may rely on the Guardia di Finanza; the national accreditation body assesses and monitors conformity assessment bodies; the AI authorities cover products that are also high-risk AI systems; Banca d'Italia, CONSOB and IVASS cover the entities they supervise; the Data Protection Authority acts within its remit. Consumer reports: CSIRT Italia. → |
| JapanNational Cybersecurity Office (国家サイバー統括室) | National Cybersecurity Office (国家サイバー統括室) (opens in a new tab) |
| – | – |
| JordanNational Cyber Security Center (NCSC) | National Cyber Security Center (NCSC) (opens in a new tab) | – | – | – |
| KenyaNational Computer and Cybercrimes Coordination Committee (NC4) | National Computer and Cybercrimes Coordination Committee (NC4) | – | – | – |
| KosovoCyber Security Agency (Agjencia për Siguri Kibernetike) | Cyber Security Agency (Agjencia për Siguri Kibernetike) | – | – | – |
| LatviaCERT.LV | CERT.LV (opens in a new tab) | – | Competent authority and single point of contact: National Cyber Security Centre, within the Ministry of Defence. CSIRT: CERT.LV. → | – |
| LiechtensteinStabsstelle Cyber-Sicherheit (SCS) | Stabsstelle Cyber-Sicherheit (SCS) (opens in a new tab) |
| – | – |
| LithuaniaNacionalinis kibernetinio saugumo centras (NKSC) | Nacionalinis kibernetinio saugumo centras (NKSC) (opens in a new tab) | – | Competent authority, single point of contact and CSIRT: National Cyber Security Centre (NKSC), under the Ministry of National Defence, which runs CERT-LT. → | – |
| LuxembourgHaut-Commissariat à la Protection nationale (HCPN) | Haut-Commissariat à la Protection nationale (HCPN) (opens in a new tab) | – | Competent authority and single point of contact: Institut Luxembourgeois de Régulation (ILR); the CSSF for banking and financial market infrastructures. CSIRT: GOVCERT.LU for the public sector and CIRCL for the private sector. → | – |
| MalaysiaNational Cyber Security Agency (NACSA) | National Cyber Security Agency (NACSA) (opens in a new tab) |
| – | – |
| MaltaNational Cybersecurity Coordination Centre (NCC-MITA) | National Cybersecurity Coordination Centre (NCC-MITA) (opens in a new tab) | – | Competent authorities: Critical Infrastructure Protection (CIP) Department and, for digital infrastructure and postal services, the Malta Communications Authority (MCA). CSIRT: CSIRTMalta, within MITA (designation updated by L.N. 89 of 2026). → | Notifying authority: Malta Digital Innovation Authority (MDIA), with the assessment and monitoring of bodies entrusted to the National Accreditation Board. Market surveillance (from 11 December 2027): MDIA. Coordinating CSIRT (from 11 December 2027): the national CSIRT (CSIRTMalta, within MITA). → |
| MauritiusComputer Emergency Response Team of Mauritius (CERT-MU) | Computer Emergency Response Team of Mauritius (CERT-MU) (opens in a new tab) | – | – | – |
| MexicoAgencia de Transformación Digital y Telecomunicaciones (ATDT) | Agencia de Transformación Digital y Telecomunicaciones (ATDT) (opens in a new tab) | – | – | – |
| Montenegro | – |
| – | – |
| MoroccoDirection Générale de la Sécurité des Systèmes d'Information (DGSSI) | Direction Générale de la Sécurité des Systèmes d'Information (DGSSI) (opens in a new tab) | – | – | – |
| NetherlandsNationaal Cyber Security Centrum (NCSC-NL) | Nationaal Cyber Security Centrum (NCSC-NL) (opens in a new tab) | – | Competent authorities: sectoral supervisors, including the Dutch Authority for Digital Infrastructure (RDI), the Human Environment and Transport Inspectorate (ILT), the Health and Youth Care Inspectorate (IGJ) and the central bank (DNB). Single point of contact: the Minister of Justice and Security. CSIRT: the National Cyber Security Centre (NCSC), also for municipalities, and sectoral CSIRTs such as Z-CERT for healthcare. → | Market surveillance and notifying authority: Dutch Authority for Digital Infrastructure (RDI). → |
| New ZealandNational Cyber Security Centre (NCSC) | National Cyber Security Centre (NCSC) (opens in a new tab) | – | – | – |
| NigeriaOffice of the National Security Adviser (ONSA) | Office of the National Security Adviser (ONSA) |
| – | – |
| North MacedoniaNational Centre for Computer Incident Response (MKD-CIRT) | National Centre for Computer Incident Response (MKD-CIRT) (opens in a new tab) |
| – | – |
| NorwayNasjonal sikkerhetsmyndighet (NSM) | Nasjonal sikkerhetsmyndighet (NSM) (opens in a new tab) |
| – | – |
| PanamaAutoridad Nacional para la Innovación Gubernamental (AIG), Dirección Nacional de Ciberseguridad | Autoridad Nacional para la Innovación Gubernamental (AIG), Dirección Nacional de Ciberseguridad (opens in a new tab) | – | – | – |
| Peru | – |
| – | – |
| PhilippinesDepartment of Information and Communications Technology (DICT) | Department of Information and Communications Technology (DICT) (opens in a new tab) | – | – | – |
| PolandCERT Polska (NASK) | CERT Polska (NASK) (opens in a new tab) | – | Competent authorities: sectoral ministers and, for finance, the Financial Supervision Authority (KNF). Single point of contact: the minister for digital affairs. National CSIRTs: CSIRT NASK (CERT Polska), CSIRT GOV (Internal Security Agency) and CSIRT MON (Defence), plus sectoral CSIRTs. → | – |
| PortugalCentro Nacional de Cibersegurança (CNCS) | Centro Nacional de Cibersegurança (CNCS) (opens in a new tab) | – | National authority, single point of contact and CSIRT: National Cybersecurity Centre (CNCS), which runs CERT.PT, with sectoral authorities for some areas. → | – |
| QatarNational Cyber Security Agency (NCSA) | National Cyber Security Agency (NCSA) (opens in a new tab) | – | – | – |
| RomaniaDirectoratul Național de Securitate Cibernetică (DNSC) | Directoratul Național de Securitate Cibernetică (DNSC) (opens in a new tab) | – | Competent authority, single point of contact and national CSIRT: National Cyber Security Directorate (DNSC), with sectoral authorities for some areas. → | – |
| RwandaNational Cyber Security Authority (NCSA) | National Cyber Security Authority (NCSA) (opens in a new tab) | – | – | – |
| SamoaSamoa Computer Emergency Response Team (SamCERT) | Samoa Computer Emergency Response Team (SamCERT) (opens in a new tab) | – | – | – |
| Saudi ArabiaNational Cybersecurity Authority (NCA) | National Cybersecurity Authority (NCA) (opens in a new tab) | – | – | – |
| SerbiaRegulatory Agency for Electronic Communications and Postal Services (RATEL) | Regulatory Agency for Electronic Communications and Postal Services (RATEL) (opens in a new tab) |
| – | – |
| SingaporeCyber Security Agency of Singapore (CSA) | Cyber Security Agency of Singapore (CSA) (opens in a new tab) |
| – | – |
| SlovakiaNárodný bezpečnostný úrad (NBÚ) | Národný bezpečnostný úrad (NBÚ) (opens in a new tab) | – | Competent authority and single point of contact: National Security Authority (NBÚ). CSIRT: SK-CERT, NBÚ's national CSIRT, and CSIRT.SK for public administration. → | Market surveillance: National Security Authority (NBÚ), since 1 January 2026. The Office of Standards, Metrology and Testing (ÚNMS) can fine notified bodies. → |
| SloveniaUrad Vlade RS za informacijsko varnost (URSIV) | Urad Vlade RS za informacijsko varnost (URSIV) (opens in a new tab) | – | Competent authority and single point of contact: Government Information Security Office (URSIV). CSIRT: SI-CERT, within the academic network Arnes, and SIGOV-CERT for government bodies. → | – |
| South KoreaNational Cyber Security Center (NIS) | National Cyber Security Center (NIS) (opens in a new tab) | – | – | – |
| SpainInstituto Nacional de Ciberseguridad (INCIBE) / Centro Criptológico Nacional (CCN) | Instituto Nacional de Ciberseguridad (INCIBE) / Centro Criptológico Nacional (CCN) (opens in a new tab) |
| Today, under Royal Decree-Law 12/2018: sectoral competent authorities, with the Department of National Security as single point of contact; reference CSIRTs INCIBE-CERT, CCN-CERT and ESPDEF-CERT. The draft bill would create a National Cybersecurity Centre. → | Under the draft: notifying authority, the National Cryptologic Centre (CCN); market surveillance, the Secretariat of State for Telecommunications and Digital Infrastructure (SETID), with INCIBE as supporting technical laboratory; single liaison office, the Directorate-General for Consumer Affairs. → |
| Sri LankaSri Lanka CERT | Sri Lanka CERT (opens in a new tab) | – | – | – |
| SwedenNationellt cybersäkerhetscenter (NCSC-SE) | Nationellt cybersäkerhetscenter (NCSC-SE) (opens in a new tab) | – | Supervisory authorities: sectoral, including the Energy Agency, the Transport Agency, Finansinspektionen, the Post and Telecom Authority (PTS) and some county administrative boards. Single point of contact and CSIRT: the National Defence Radio Establishment (FRA), through the National Cyber Security Centre, which includes CERT-SE. → | Market surveillance and notifying authority: designated by the government; the inquiry makes proposals in its report. → |
| SwitzerlandBundesamt für Cybersicherheit (BACS) | Bundesamt für Cybersicherheit (BACS) (opens in a new tab) |
| – | – |
| TaiwanAdministration for Cyber Security - Ministry of Digital Affairs | Administration for Cyber Security - Ministry of Digital Affairs (opens in a new tab) |
| – | – |
| ThailandNational Cyber Security Agency (NCSA) | National Cyber Security Agency (NCSA) (opens in a new tab) | – | – | – |
| TunisiaAgence Nationale de la Cybersécurité (ANCS) | Agence Nationale de la Cybersécurité (ANCS) (opens in a new tab) | – | – | – |
| TürkiyeSiber Güvenlik Başkanlığı (Cyber Security Presidency) | Siber Güvenlik Başkanlığı (Cyber Security Presidency) (opens in a new tab) |
| – | – |
| UgandaNational Information Technology Authority - Uganda (NITA-U) | National Information Technology Authority - Uganda (NITA-U) (opens in a new tab) | – | – | – |
| UkraineState Service of Special Communications and Information Protection (SSSCIP) | State Service of Special Communications and Information Protection (SSSCIP) (opens in a new tab) | – | – | – |
| United Arab EmiratesUAE Cyber Security Council | UAE Cyber Security Council (opens in a new tab) | – | – | – |
| United KingdomNational Cyber Security Centre (NCSC) | National Cyber Security Centre (NCSC) (opens in a new tab) |
| – | – |
| United StatesCybersecurity and Infrastructure Security Agency (CISA) | Cybersecurity and Infrastructure Security Agency (CISA) (opens in a new tab) |
| – | – |
| UruguayAgencia de Gobierno Electrónico y Sociedad de la Información y del Conocimiento (Agesic) | Agencia de Gobierno Electrónico y Sociedad de la Información y del Conocimiento (Agesic) (opens in a new tab) | – | – | – |
| VanuatuCERT Vanuatu (CERTVU) | CERT Vanuatu (CERTVU) (opens in a new tab) | – | – | – |
| ZambiaZambia Cyber Security Agency | Zambia Cyber Security Agency | – | – | – |
“–” means no data for that country.
Sources: country pages, NIS 2 transposition, Obligations compared and Implementation of the CRA · list of EU CSIRTs Network members (opens in a new tab) · JSON