European cooperation: resilience starts on the ground

A cyber crisis rarely respects the boundaries of an organisation. Software used by several municipalities is compromised, an IT provider loses its access, a hospital can no longer reach a service hosted abroad: within minutes, a local incident becomes a regional, national or European problem.

There is a lot of talk about cooperation. In practice, it starts with very ordinary things: a number that answers at night, a shared vocabulary, a channel that works when the usual email is down, and people who have already spoken to each other before the crisis.

The first signal often comes from the ground

A small organisation sees the symptoms before the authorities do: accounts get locked, files carry an unknown extension, a supplier announces a strange delay or customers receive fake messages.

That organisation does not always know how to classify the event. Is it an outage, a fraud, an attack or an internal error? It hesitates to report because it fears being wrong, being held responsible or revealing a weakness.

Useful cooperation must make the first contact simple. The person reporting should not have to produce a perfect technical report straight away. They need to know who to call, what evidence to preserve and what actions to avoid.

An early but incomplete report is often worth more than a flawless notification sent three days later.

NIS2 creates a common language

The NIS2 directive extends risk management and notification obligations for essential and important sectors. In Belgium, it pushes the organisations concerned to identify who is responsible, document their dependencies and organise their response.

Its most lasting contribution may be cultural. It forces management to see cybersecurity as a matter of continuity, not merely an IT problem.

But collective resilience cannot create two worlds: large regulated entities that run exercises and small organisations left to fend for themselves. The plan templates, training and scenarios developed for NIS2 must be adapted for the municipalities, associations, schools and SMEs that sit in the same chains of dependency.

Sharing quickly does not mean sharing everything

During an incident, some information is immediately useful to others: a fraudulent domain, a file hash, an exploitation method or an observed behaviour.

Other elements require a narrower channel: personal data, internal architecture, an unpatched vulnerability, information covered by an investigation or trade secrets.

Mature cooperation defines several levels of distribution before the crisis. It specifies who may receive what, for how long and under whose responsibility. This avoids two extremes: passing on nothing for fear of saying too much, or circulating a sensitive file to an entire list of partners.

The national plan must meet local reality

In 2026, Belgium revised its national cyber crisis response plan. This framework organises national coordination and its link with European mechanisms.

For a local player, a national plan is only worth something if it translates into concrete actions:

• a known point of contact;
• a procedure compatible with the organisation's real working hours;
• help in classifying the incident;
• a secure way of transferring evidence;
• feedback on what will be done with the report.

Local officials should not discover that the system exists while their servers are already down.

An exercise reveals what a document hides

On paper, everyone knows who to call. During an exercise, the number belongs to someone on holiday, the document is stored on the server that is simulated as unreachable and the supplier is not in the loop.

The most useful exercises do not try to impress. They test ordinary decisions under pressure:

1. can we meet if email and the directory are down?
2. who decides to shut down a service?
3. how do we warn the public without confirming an uncertain hypothesis?
4. do we have the contractual right to obtain the supplier's logs quickly?
5. which service must come back first?

A short two-hour simulation can deliver more than a fifty-page plan that is never opened.

The supplier is part of the crisis team

Organisations outsource hosting, email, backups and sometimes all of their IT administration. They cannot outsource responsibility so easily.

The contract should cover notification deadlines, access to logs, participation in exercises, preservation of evidence and the exit procedure. You also need to know the supplier's own subcontractors: an invisible chain quickly becomes an uncontrollable one.

During a crisis, the provider must know who has the authority to request a shutdown or a restore. The organisation must have a way of contacting it that does not depend on the service that is down.

Communication is an operational function

Late communication lets rumours fill the vacuum. Overly assertive communication can spread an error or complicate the investigation.

A good message distinguishes between:

• what has been observed;
• what has been confirmed;
• what is still being analysed;
• what users need to do now;
• when new information will be published.

This structure works in a municipality just as it does at European level. It allows several institutions to speak coherently without claiming to have all the answers.

Brussels links several levels of response

Belgium hosts European institutions, diplomatic networks and a large number of suppliers operating in several countries. It is therefore at once a target, a beneficiary and a contributor to European resilience.

The national CSIRTs, ENISA and European mechanisms make it possible to share indicators and coordinate cross-border crises. The value of these networks, however, depends on the quality of the information that comes up from the ground.

The flow must work both ways: European alerts down to local players, but also local observations up to those who can see the same phenomenon in several countries.

A preparation model for a small organisation

A municipality, a non-profit or an SME can start without a complex platform:

• appoint a person in charge and a deputy;
• print a page of crisis contacts;
• ask the provider for its emergency number and commitments;
• keep the list of priority services offline;
• test a restore and a crisis call once a year;
• note in advance what must be preserved in the event of an incident.

The organisation can then take part in a sector-wide or regional exercise. The aim is not to get through without mistakes, but to discover the blockages while they are still harmless.

Turning lessons learned into decisions

After an exercise or an incident, the same findings often come up: overly broad access, dependence on a single person, a vague contract, an untested backup. A lessons-learned review is only valuable if each finding is given an owner, a deadline and a budget.

Sharing an anonymised version of these lessons helps other organisations. Cooperation then becomes cumulative: every incident avoided or better handled increases shared capability.

Official sources

• CCB — Belgium adopts a new national cyber crisis response plan
• European Commission — NIS2 directive
• CCB — ten years of building Belgium's digital resilience