NIS2 Incident Reporting: 24-Hour Early Warning, 72-Hour Notification, 1-Month Final Report

The Three Primary Deadlines

What Is a Significant Incident?

Significance turns on severe operational disruption, financial loss, or impact on other natural/legal persons. National guidance and CSIRT practice refine thresholds — document your internal severity model against those expectations.

Operational Prerequisites

• 24/7 awareness path (SOC, MDR, or on-call) so the 24-hour clock starts from real awareness
• Pre-approved notification templates and authority contacts
• Logging/monitoring evidence — see NIS2 logging requirements
• Coordination with GDPR Article 33/34 when personal data is involved

How CyberSilo Helps

• Article 21 evidence map and gap tracking in CSA for NIS2
• Article 23 reporting clocks with ThreatHawk SIEM detection workflows
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Is the early warning really 24 hours?

Yes. Article 23 requires an early warning within 24 hours of becoming aware of the significant incident.

Does the 72-hour notification replace the early warning?

No. Early warning (24h) and incident notification (72h) are sequential steps, followed by a final report within one month and any required intermediate updates.

What if we are still investigating at 24 hours?

Submit the early warning with what you know; update at 72 hours and in later reports. Waiting for perfect forensics is not the design of Article 23.

Related NIS2 Resources

NIS2 hub · ThreatHawk · Fines · CSA