National Cyber Security Authority (Israel)

The Authority was the civilian operational arm of Israel’s national cyber-defense system. Created under Government Decision 2444 in February 2015 and operational in 2016, it handled civilian cyber incidents, operated the National CERT, and promoted resilience across the economy.[1][5]

It worked alongside the National Cyber Bureau and security agencies until the Bureau and Authority were merged into the National Cyber Directorate in January 2018.[3][6]

The government approved Resolution 2444 on February 15, 2015, establishing the National Cyber Defense Authority as a civilian body in the Prime Minister’s Office. Its purpose was to protect civilian cyberspace and critical assets, help preserve the functioning of critical infrastructure, and contribute to cyber regulation through sectoral regulators.[1][2] The government described the safe and proper functioning of cyberspace as an essential national-security objective.[5]

The plan followed preparatory work on the need for a dedicated body to concentrate expertise, connect civilian and security domains, and direct national defensive activity over the long term. On September 21, 2014, Prime Minister Benjamin Netanyahu announced plans for an operational authority that would protect the civilian sphere while operating alongside the National Cyber Bureau. The announcement framed protection broadly, extending beyond facilities and security agencies to Israeli citizens.[7]

The Authority’s approval and operational launch were separate milestones. Its own two-year summary says it began operating at the beginning of 2016 following the appointment of its head; an INSS study dates its official start to April 2016. In its initial period it built staff, organizational processes, operational capabilities, and specialized technologies.[2][5] The sources also use variant institutional names, including National Cyber Defense Authority and National Cyber Security Authority.

The Authority’s central task was to direct and carry out national cyber-defense efforts to provide “a full and constant defensive response to cyberattacks.” Its remit included responding to threats and incidents in real time, maintaining an ongoing national situation assessment, gathering and researching intelligence, and coordinating with special institutions. Its director was subordinate to the head of the National Cyber Staff.[1]

The Authority’s responsibilities included managing national operational cyber defense and operating a National CERT to assist the civilian economy with threats and incidents. It also worked to strengthen resilience through preparedness, guidance, regulation, licensing, standards, exercises, training, and incentives, and to formulate and embed a national cyber-defense doctrine.[5] The National CERT began operating in Be’er Sheva in early October 2016. Staffed around the clock by cyber-defense analysts, the center received, monitored, and handled reports and incidents in civilian cyberspace.[5]

The government’s plans also envisioned a “Cyber Event Readiness Team,” an assistance center intended to help organizations and economic sectors address threats and improve resilience. Measures associated with the Authority’s establishment included organizing the cyber-defense services market, developing cyber assessments through existing regulators, and offering incentives to improve organizations’ readiness.[8]

By the end of 2017, the Authority was handling an average of about 100 organizations with confirmed intrusions each month, compared with about 50 incidents per month in 2016.[5] During a worldwide ransomware incident in May 2017, it issued guidance and coordinated information gathering with overseas counterparts and security companies. Its recommendations included keeping an isolated backup, applying software and security updates, and treating messages, files, and links from unknown sources cautiously.[9]

The Authority’s organizational cyber-defense methodology was made freely available as a recommendation for organizations across Israel’s economy. It aimed to help them assess risks and create multi-year plans, scaling protections to the potential damage of an incident. The methodology combined international approaches with Israeli civil and security experience and adaptation to Israel’s environment and business culture.[10]

The methodology placed primary responsibility for protecting an organization’s information on its management and called for investment proportionate to the criticality of each asset. It presented cyber defense as proactive and multilayered, encompassing prevention, detection, response, and recovery, with the goal of protecting organizational continuity and business objectives.[10]

The Authority’s civilian remit did not encompass security institutions, bodies directed by the chief of security in the defense establishment, or other excluded institutions. Its creation raised questions about how responsibilities should be divided among the Authority, the National Cyber Bureau, the Israel Security Agency, and other bodies.[1]

The Authority was expected eventually to assume some work traditionally performed by the Israel Security Agency in protecting critical national infrastructure. Disagreements over the division of responsibility accompanied its establishment, and the two agencies drafted a memorandum of understanding on June 9, 2016, to regulate their activities. An INSS study characterized the tension as inherent and likely to continue.[1] The Authority reported that from March 2017 it directly guided critical national-infrastructure bodies while cooperating with the Israel Security Agency.[5]

In 2016, the Knesset Foreign Affairs and Defense Committee questioned the need for two independent authoritative bodies dealing with cyberspace in the Prime Minister’s Office. It recommended that the Authority rely on intelligence gathered by existing bodies and open sources rather than become another intelligence agency, and called for clearer arrangements among the organizations involved.[1]

The regulatory landscape was divided among sectoral regulators. Binding directives applied to some strategically important sectors, while much of the private sector was not subject to binding regulation. An INSS study reports that the transfer of powers from the Authority to the Israel Security Agency for 26 critical infrastructures was completed in July 2017, while the government summary describes the Authority as directly guiding critical-infrastructure bodies in cooperation with that agency.[2][5]

The National Cyber Security Authority and the National Cyber Bureau were consolidated into the Israel National Cyber Directorate within the Prime Minister’s Office around the end of 2017 or the beginning of 2018. The government approved the merger in December 2017, and the new directorate began operations in January 2018.[4][6] The Bureau and Authority had operated simultaneously, with several reports describing the Bureau as responsible for strategy and the Authority for operations; accounts differ, however, on how their respective functions were divided.[6][11]

The Knesset passed an amendment on December 27, 2018, providing a statutory basis for unifying the Bureau and Authority into the Israel National Cyber Directorate, which operates directly under the prime minister. The amendment concerned the Regulation of Security in Public Bodies Law, which covers security protections for certain listed public bodies providing essential public services, including computerized systems and information security.[12]

The unification amendment should be distinguished from broader legislation proposed in a July 2018 memorandum. That memorandum described intended directorate functions such as managing national defensive operations, improving Israel’s capacity to address attacks, promoting international cooperation, and advising the government and its cyber committees. It presented the directorate as working alongside, rather than replacing, other security and law-enforcement bodies.[12]

The memorandum’s preliminary draft proposed collecting targeted data from government ministries and other identified organizations for real-time analysis and early detection. It also proposed powers to request information, enter premises on reasonable suspicion, and confiscate items for testing. Proposed safeguards included judicial approval for certain actions, an internal privacy supervisor, and an external committee focused on privacy effects.[12] These were proposals in the memorandum, not powers established by the 2018 unification amendment. The Library of Congress account reported that the directorate’s mission, functions, and authority had not yet been regulated by law in the material it reviewed, and that the relationship between the memorandum and existing security legislation remained unresolved.[12]

The Authority’s work included cooperation beyond Israel. In June 2016, the heads of the National Cyber Bureau and National Cyber Security Authority signed a cyber-defense cooperation agreement with U.S. Department of Homeland Security officials. The agreement called for sharing important information and developing “tandem cyber-defense infrastructures.”[13]

After the merger, the National Cyber Directorate’s foremost task was protecting Israeli cyberspace. Its national CERT in Be’er Sheva operated around the clock, providing assistance and guidance to citizens and organizations and cooperating with emergency centers abroad.[3]

On March 2, 2022, the director-general of the National Cyber Directorate and a U.S. Department of Homeland Security under secretary signed an agreement to enhance bilateral cyber cooperation. Reported areas included protecting the countries’ economies and critical infrastructure, cyber-risk management, countering ransomware, research and development, public-private partnerships, information sharing, and expert exchanges.[14]

The Authority represented a shift toward a dedicated civilian operational body focused on cyber defense across the economy, complementing national policy and security organizations rather than replacing them. Its remit connected incident response and operational defense with preparedness, organizational guidance, regulatory work, and efforts to improve resilience.[1][5]

Its establishment also brought into focus the challenge of coordinating cyber protection across civilian organizations, infrastructure, intelligence bodies, and security agencies. The Authority’s development—from building its capabilities and National CERT to guiding critical-infrastructure organizations—formed part of the institutional structure later consolidated in the National Cyber Directorate.[5][3]

The Authority’s boundaries with the Israel Security Agency and the National Cyber Bureau were debated, including whether two separate cyber bodies in the Prime Minister’s Office were needed and which body should lead strategy, policy, or operations.[1][11]

Sources distinguish several institutional milestones: Government Decision 2444 in February 2015 and the Authority’s operational launch in 2016.[5] The government approved the merger in December 2017, and the Directorate began operating in January 2018.[4][6] Differences in institutional terminology and descriptions of responsibility account for some variation, but the sources do not fully resolve every characterization.[2][11]