How to report to CERT.be under the CRA

1. Who receives your notification: CCB and CERT.be

The Centre for Cybersecurity Belgium (CCB) is the national authority, and CERT.be is its operational team. CCB operates from Brussels and was set up in 2015, which makes it one of the newest national authorities among those covered by these pages.

The chain is exactly this: the authority as the institution, CERT.be as the operational team that reads your notification and, together with ENISA, forms the recipient set out in Art. 14.

CCB is the Centre for Cybersecurity Belgium and operates under the Prime Minister's chancellery. CERT.be is its operational team. It is a young, centralised arrangement: one federal authority with one technical team, for a country with three official languages.

2. The national channel, in practice

The language of the notification can be Dutch, French or English: CCB routinely works in all three. For a manufacturer whose documentation is in English this is the easiest situation among the countries covered by these pages.

CCB publishes advisories and runs a coordinated vulnerability disclosure programme that is among the most explicit in Europe. If you already have a disclosure policy, check that it sits well with that framework: the two processes meet.

CERT.be · official website

3. The landscape around it

Belgium transposed NIS2 through a federal act giving CCB the role of national competent authority and single point of contact. The result is a compact ecosystem with few interfaces.

For the CRA, the designation of the CSIRT that receives manufacturers' notifications still has to be checked against the national implementation of the Regulation, which does not automatically match the NIS2 perimeter. Check it before you file.

One last practical point: Belgium hosts many European institutions, and CCB works in a setting where coordination with ENISA and the European networks is daily business. For a manufacturer that means procedures aligned with common practice and few local quirks to learn.

4. How filing works, in short

Filing is not an email to the authority: it goes through the single reporting platform established by Art. 16, and access requires EU Login credentials validated beforehand.

The chain of deadlines — 24 hours, 72 hours, final report — is the same across the Union and is set out in full on the Art. 14 page. For the article’s other trigger the final deadline changes: it is on the severe incident page.

5. What to prepare before an incident

Five things, arranged calmly, make the difference between a report filed in time and one filed too late. The first is the contact point to CERT.be, designated and validated, with a named substitute: on the day of the case you do not go looking for whoever holds the credentials.

In Belgium it pays to decide in advance which language you will file in and to keep it consistent across early warning, update and final report: three documents in three languages on one case make life hard for whoever has to correlate them.

And a note on time: Belgium runs on CET/CEST. The twenty-four hours run through public holidays too, and in an organisation working across three languages it helps if the contact point and the deputy share the same filing language, so the handover does not add a translation.

This guide describes our reading of the regulatory text and the public procedures; it does not constitute legal advice, and the platform's operational details may evolve.