OZON 2025: what have we learned?

The fifth edition of the biennial sector-wide crisis exercise for education and research OZON took place in March (also read the report From protest to cyber crisis: this is how realistic an OZON exercise can be). Clearly, institutions learned a great deal. Especially those that have taken part in OZON more than once. With each exercise, organisations take new steps and improve specific parts of their crisis escalation process.

One example is TU/e. Earlier this year, they found that their response to the cyberattack had significantly improved thanks to extensive practice and the fact that the lessons learned from previous exercises had  been acted upon. 

Structured information sharing remains a key focus

One of the main points for attention from the previous OZON exercise (2023) was the sharing of information between institutions at operational, tactical, and strategic levels. This year, we saw that a great deal of information was exchanged at all levels, which is positive. However, there are still insufficient agreements on how to do this in a structured way. As a result, noise arises, both within and between the different levels.

Maintain multisectoral strategic coordination meetings

In recent years, we have explored what coordination on a strategic level should look like during a crisis. We tested this multisectoral set-up during OZON this year. External experts guided and tested the process.

They recommended retaining this consultation during large-scale cyber crises. But with the note to keep it small, flexible and approachable. It is also important that this body is not used to compensate for shortcomings in information flows elsewhere, and that it should not slow down decision-making.

Follow-up steps

In the lead-up to the next OZON in 2027, we will explore the best approach to information management during a large-scale cyber crisis: what can we learn from other sectors, such as healthcare or defence?

And: we keep practising. You can do so in March 2026 with your own institution during the tabletop exercise NOZON, the light variant of OZON. Of course, if you want to exercise earlier, you can do so too. In that case, use the NOZON manual. There you will find all the information you need to organise a good exercise. The manual also contains a number of sample scenarios.

Want to participate in NOZON 2026?

Register your institution by 30 November 2025 at the latest!