Belgium's 2026 CER Strategy

CER subscription

Be the first to know about CER updates and suggest topics you want covered, please subscribe to our KPMG newsletters.

The strategic direction is clear: resilience should be considered across the full ecosystem that keeps an essential service operating, not only at the level of individual assets or infrastructures.

What the strategy focuses on

Belgium's strategy sets the national direction for implementing the Critical Entities Resilience (CER) framework. It responds to an evolving threat landscape in which cyber incidents, extreme weather, health emergencies, sabotage, and other disruptions may spread across interconnected sectors and borders. Its focus is therefore broader than physical protection: it seeks to strengthen the ability of critical entities to anticipate disruption, continue essential services, and recover effectively.

The strategy is organized around three objectives:

ALL-RISK APPROACH

Create a coherent framework that addresses natural, human-made, technological, cyber, health, and emerging risks.

RESILIENCE

Increase the capacity of critical entities to prevent, detect, withstand, and recover from incidents.

SHARED RESPONSIBILITY

Build cooperation between competent authorities and the entities responsible for delivering essential services.

Olivier Elst

Partner | Advisory

KPMG in Belgium

mail
call

What this means for organizations

For organizations, the central question is no longer limited to whether individual assets are protected. It is whether the essential service can continue when a major disruption occurs. For designated critical entities, the strategy reinforces the need to connect risk management, business continuity, physical security, cybersecurity, crisis management, and resilience across key dependencies. It also makes clear that organizations remain primarily responsible for implementing proportionate measures, while sectoral authorities and the National Crisis Centre provide coordination, guidance, and oversight.

The strategy may also be relevant beyond designated critical entities, as the resilience of essential services can depend on external providers, infrastructure, and cross-sector relationships. This requires organizations to understand not only their own operations, but also the external services, infrastructure, and dependencies that support the delivery of essential services.

Key highlights for organizations

Eight national priorities translate the strategy into action. The following themes are most relevant for corporate readers.

Understand risk across the full service ecosystem

Risk awareness is positioned as the first line of defense. National, sectoral, and entity-level assessments should use an all-hazards perspective and consider links between risks, cross-sector dependencies, and cross-border effects.
Build a trusted resilience community

The strategy promotes active information exchange, shared practices, and cooperation among authorities and critical entities. The National Crisis Centre coordinates and facilitates this community, while sectoral authorities lead implementation in their domains.
Support the practical implementation of CER requirements

For designated critical entities, the wider CER framework requires risk assessment, an up-to-date overview of critical infrastructure, a point of contact, proportionate resilience measures, a resilience plan, and incident notification.
Treat cyber as one pillar of broader resilience

Entities designated under CER are also treated as essential entities under the Belgian NIS2 framework. The strategy therefore emphasizes coordination between the CER and NIS2 authorities, as well as a coherent approach to physical, operational, and digital resilience.
Manage resilience as a continuous process

Risk assessments, identification processes, and the national strategy are subject to periodic review. Plans and measures should also evolve when risks, dependencies, or operating conditions change.
Look beyond organizational and national boundaries

The strategy recognizes that essential services often depend on infrastructure, corporate structures, and suppliers across sectors and Member States. Cross-border consultation and European cooperation are therefore integral to the approach.

Executive takeaway

Belgium is moving from a model centered on protecting individual infrastructure towards a coordinated and adaptive resilience ecosystem. For organizations, the practical starting point is to identify the essential services they support, understand the people, sites, systems, suppliers, and utilities on which those services depend, and ensure that resilience measures remain effective as risks and operations evolve.

_{Source: Belgian National Crisis Centre, Critical Infrastructure Protection and Risk Analysis, Strategy on the Resilience of Critical Entities 2026. Content has been summarized and paraphrased for external communication.}