Incident Reporting to National CERT: 72-Hour (CII) and 120-Hour Rules Under PISF 2026

The Two Primary Clocks

Operational Prerequisites

• SOC or on-call path so “immediate” is realistic
• Pre-filled National CERT / sectoral contact list
• Case timers in SIEM / IR tooling for 72h and 120h
• Evidence retention aligned to PISF monitoring themes

CERT Rules 2023 — Separate Instrument

National CERT Rules 2023 address CERT structure and cooperation duties. Mention them in programme docs, but avoid treating an unverified secondary “one-hour PISF” deadline as if it were PISF 2026. Prefer the PISF 72 / 120 framing for this dedicated page, then verify any additional Rules obligations with counsel.

Older “72-Hour Only” Posts

Earlier site content focused on CII 72-hour reporting under draft PISF 2025 naming. Treat this page as the September 2026 reference for 72 + 120 under PISF 2026 branding.

How CyberSilo Helps

• Incident case timers and packages with ThreatHawk
• Control evidence in CSA for PISF 2026
• Playbook reviews — contact CyberSilo

Frequently Asked Questions

What is the CII detailed reporting clock under PISF themes?

Immediate notification for Critical Information Infrastructure, with a detailed report within 72 hours — per published PISF 2026 materials framing used on this site.

What about non-CII public sector?

PISF themes cite 120 hours for non-CII public sector detailed reporting. Confirm classification for your entity.

Do CERT Rules 2023 change these hours?

CERT Rules 2023 are a separate instrument. Prefer the PISF 72/120 framing on this page; verify any additional CERT Rules obligations with counsel rather than assuming a one-hour PISF rule from secondary summaries.

Related Resources

Legacy CII 72h post · PISF guide · ThreatHawk