NIS2 incident reporting: 24 hours, 72 hours, one month

The NIS2 Directive changed incident reporting from a loosely defined duty into a staged process with fixed deadlines. For essential and important entities, the first report is due within 24 hours of becoming aware of a significant incident. That is not much time to work out what happened, decide whether it is significant and find the right person to submit the notification, especially at 3 a.m. on a Sunday.

The organisations that cope well are the ones that made the reporting decisions in advance.

The three stages

Article 23 of NIS2 sets out a staged approach. Each Member State implements it in national law and designates where reports go, usually the national CSIRT or the competent authority. In Belgium, for example, the Centre for Cybersecurity Belgium plays that role. The broad sequence is the same everywhere.

Early warning: within 24 hours

Without undue delay, and in any event within 24 hours of becoming aware of a significant incident, the entity sends an early warning. It is deliberately short. It should indicate, where relevant, whether the incident is suspected to be caused by unlawful or malicious acts, and whether it could have a cross-border impact.

The purpose is to alert the authority early; waiting for certainty defeats the point.

Incident notification: within 72 hours

Within 72 hours of becoming aware of the incident, the entity submits an incident notification. It updates the early warning and gives an initial assessment: the severity and impact of the incident and, where available, indicators of compromise.

The authority can also ask for intermediate reports on relevant status updates along the way.

Final report: within one month

No later than one month after the incident notification, the entity submits a final report. It contains a detailed description of the incident, including its severity and impact; the type of threat or root cause that is likely to have triggered it; the mitigation measures applied and ongoing; and any cross-border impact.

If the incident is still ongoing at that point, the entity submits a progress report instead, followed by the final report within one month of handling the incident.

Alongside these reports, entities may need to inform recipients of their services, without undue delay, about significant incidents likely to affect them, and about measures those recipients can take in response to a significant cyber threat.

What "significant" generally means

Not every incident must be reported. Under NIS2, an incident is significant if it has caused, or is capable of causing, severe operational disruption of the services or financial loss for the entity concerned; or if it has affected, or is capable of affecting, other natural or legal persons by causing considerable material or non-material damage.

Two features of this definition matter in practice. First, capable of causing means you assess potential impact, not only what has already happened. Second, the thresholds are qualitative in the Directive itself. For certain digital-sector entities, an implementing regulation sets more specific criteria; for others, national guidance may help. Either way, you need your own documented interpretation before an incident, because the 24-hour clock does not stop while you debate it.

Prepare classification criteria

Translate the definition into criteria your team can apply quickly. Typical dimensions are:

• Service impact: which services are affected, for how long and for how many users.
• Financial impact: direct losses or costs above a threshold you define.
• Impact on others: harm to customers, patients, citizens or other organisations.
• Data: confidentiality, integrity or availability of data, especially personal data.
• Cause: suspected malicious activity, which also matters for the early warning.
• Cross-border effects: services or users in other Member States.

Define what "severe" and "considerable" mean for your organisation in each dimension, and record the reasoning behind each classification decision. That record is useful evidence later, whether the decision was to report or not.

Remember that other regimes may apply to the same incident: GDPR breach notification to the data protection authority, sector rules and, for financial entities, DORA. Map where they overlap so one incident does not trigger three uncoordinated processes.

Assign roles before the incident

The reporting chain should name people, not departments:

• Who declares a suspected significant incident and starts the clock.
• Who classifies, with a deputy for nights, weekends and holidays.
• Who approves the submission, and at what level. Management bodies of NIS2 entities are accountable for cybersecurity risk-management measures, so senior involvement should be planned rather than improvised.
• Who submits to the authority and holds access to the reporting channel.
• Who communicates with affected recipients of services, and with legal, communications and data protection teams.

Record how to reach them out of hours, and test it.

Templates and evidence

Prepare drafts for each stage with the fields the authority expects, pre-filled with what does not change: entity details, sector, contacts. During an incident, the team fills in facts rather than designing a form.

Keep a timeline from the first signal: when the incident was detected, when it was classified, when each report was sent and what it said. The final report draws on this timeline, and so does any later review by the authority.

Rehearse it

A procedure that has never been run will fail on the first real incident. Include reporting in your exercises: a tabletop scenario where the team must decide significance and draft the early warning within the time limit is often enough to expose missing contacts, unclear approval rules and templates that ask for information nobody has. Record what went wrong and fix it before the next exercise.

In short

NIS2 reporting rewards preparation. Agree your criteria, name your people, prepare your templates and rehearse the first 24 hours. Tools can help by keeping incidents, classifications, playbooks and exercise results in one place and by drafting notifications for a person to review, but the decisions about what counts as significant are yours to make in advance.

This article is general information, not legal advice.