ITER/BEBelgium
What the record establishes for Belgium: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Autorité de la protection des données / Gegevensbeschermingsautoriteit reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | The national CSIRT, which article 1, 46° defines functionally as the national computer security incident response center without naming the body binding | Article 34 §1 leaves the arrangements to a protocol between the national CSIRT and the NCCN. The act does not set them out. The Centre publishes the platform on its own pages, at notif.safeonweb.be, with a telephone line for an emergency. No address is recorded in this row: every host in the Centre's estate answers 403 to an automated request, so the host is known to exist and the path could not be confirmed. | be loi 26 04 2024 |
| Financial supervisorDORA, article 19 | Nationale Bank van België / Banque Nationale de Belgique reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Autoriteit voor Financiële Diensten en Markten / Autorité des services et marchés financiers (FSMA) reported | — | esma mar nca |
Transposition of NIS2 binding
| Act | Loi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la sécurité publique |
|---|---|
| In force | 18 October 2024, by article 98 |
| Recipient | The national CSIRT, which article 1, 46° defines functionally as the national computer security incident response center without naming the body |
| Moves a term | No. None. Article 35 §1 transposes the cascade term for term and anchor for anchor: the early warning «dans les vingt-quatre heures après avoir eu connaissance de l'incident significatif», the incident notification «dans les septante-deux heures» on the same footing, and the final report «au plus tard un mois après la présentation de la notification d'incident». Trust service providers get twenty-four hours for the second stage under §2. Where an incident is still running when the final report falls due, §1, 5° gives a progress report then and the final report within one month of the incident's definitive handling. |
| Standing | Read in the act, in the Justel database of the Moniteur belge, and not in guidance. One thing the act does not settle: it defines the national CSIRT by what it does rather than by name, so this record does not name it either. Article 34 §1 adds that the CSIRT passes each notification to any sectoral authority immediately, and that notifications from essential entities also go to the NCCN. |
| Source | be loi 26 04 2024 |
An event in Belgium
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.