Draft; consultation closed 10 July 2026; no final as of 20 October 2026
Last verified
2026-10-20
A draft NCA framework on cybersecurity incident reporting and information sharing.
Reporting: as drafted, all public and private entities would report any actual or suspected incident through Haseen.
Severity: five levels, from Level 1 (catastrophic) to Level 5 (a single workstation).
NCA requests: four response tiers: immediate (2 hours), very urgent (12 hours), urgent (48 hours) and normal (72 hours).
Other duties: keep records for at least 15 years; run annual drills; share under the Traffic Light Protocol (TLP).
Status: consultation closed 10 July 2026; no final framework as of 20 October 2026. The code NFCISIR-1:2026 used in secondary sources is not confirmed.
Updates for this instrument
2026-06-08 · NCA consults on national framework for cybersecurity information sharing and incident response: As drafted, all public and private entities must report any actual or suspected incident through Haseen. Five severity levels apply, from Level 1 (catastrophic) to Level 5 (a single workstation). Separately, four respons