NCSC and the Digital Trust Center have merged into one desk: what changes for your organisation

Two years ago, a director in the Netherlands knew exactly where to turn. A question about baseline security went to the Digital Trust Center, a reportable incident went to the National Cyber Security Centre. Since 1 January 2026, that distinction no longer exists. The Digital Trust Center and the Computer Security Incident Response Team for digital service providers have merged into the NCSC, which now calls itself the point of contact for digital resilience for more than 2 million Dutch organisations.

For anyone who still has a bookmark to digitaltrustcenter.nl, this is more than a rebrand. This is a Dutch government reorganisation, so it explains what exactly merged, why it happened, and what it practically means for your organisation, whether or not you fall under the mandatory reporting duty of the Dutch Cyberbeveiligingswet.

What changed on 1 January

Since 1 January 2026, the Digital Trust Center and the Computer Security Incident Response Team for Digital Service Providers have been merged into the NCSC. That is stated directly in the NCSC's own 2026 annual plan. Information from both organisations now lives on a renewed website, ncsc.nl, and the familiar campaigns and baseline advice from the Digital Trust Center have been moved there.

The NCSC itself describes the merger as a way to reduce fragmentation. Where an organisation with a simple question about password policy used to end up at a different desk than an organisation with a reportable incident, both now go through the same front door.

Why this is more than a name change

Until recently, the two organisations had different roles. The Digital Trust Center mainly focused on broad outreach and baseline measures for smaller organisations: the free CyberVeilig Check, campaigns around password managers and phishing, and the Mijn Cyberweerbare Zaak grant scheme. The NCSC traditionally served central government and critical sectors, with statutory tasks around mandatory reporting and threat intelligence.

With the Cyberbeveiligingswet, which has imposed a duty of care and a reporting duty on thousands of larger and critical organisations since August, the NCSC's audience grew substantially. The merger means that baseline advice for a small business and the formal reporting duty for a larger organisation within scope of the law now come from the same source, rather than from two separately operating bodies.

What does this mean for your organisation?

If you do not fall under the Cyberbeveiligingswet, little changes in daily practice: the CyberVeilig Check, the baseline advice and the grant schemes simply continue, only now under the NCSC's name and web address. Old links to digitaltrustcenter.nl may now redirect or no longer work, so a bookmark you saved for the latest password policy advice is worth checking.

If you do fall under the law, as an essential or important entity, you still report a significant incident to the NCSC, but you now deal with the same organisation that also runs the campaigns and baseline advice for smaller partners in your supply chain. That is useful if you hold your own suppliers to a baseline security standard: you can now point to one source for both the simple advice and the formal obligations.

Still in motion: watch the coming years

The merger is operational as of 1 January 2026, but not every aspect is settled for good. A written answer to parliamentary questions shows that the departments involved fund the NCSC incidentally through 2027 for the tasks the Digital Trust Center used to carry out, and that a structural budget transfer is only expected from 2028, following a 2027 evaluation. For your organisation, this mainly means the exact services, campaigns and any successors to the current grant schemes may still shift over the coming years. It is not a reason to delay baseline measures, but it is a reason to periodically check whether a scheme or contact point is still current.

What to do this month

Four concrete actions. First, update your incident response plan or security documentation: if it still lists a separate phone number or web address for the Digital Trust Center alongside the NCSC, replace it with the current contact details on ncsc.nl. Second, check whether your organisation, given its size and sector, falls within the scope of the Cyberbeveiligingswet; the self-assessment on the NCSC website clarifies that. Third, even if you fall outside the law, complete the free CyberVeilig Check; that action list often forms the basis for any grant application. Fourth, ask your key IT suppliers whether they know the baseline digital security mark, since that increasingly affects the conversation about who does business with whom.

A merger between two government bodies sounds like something a business owner can ignore. In this case, it genuinely changes where you turn with a question, a report or a grant application. Want help updating your incident response plan, determining your status under the Cyberbeveiligingswet, or getting your baseline security in order? Zarioh is happy to think it through with you.