NIS2 Incident Reporting

NIS2 Article 23(4) establishes a three-stage reporting process that balances the need for rapid awareness with the reality that comprehensive information is only available after investigation. The three stages are the early warning, the incident notification, and the final report. Each has a distinct timeline and content expectation.

The early warning must be submitted to the CSIRT or competent authority without undue delay and in any event within 24 hours of the entity becoming aware of the significant incident. The early warning is deliberately light-touch: it must indicate whether the incident is suspected of being caused by unlawful or malicious acts, and whether it could have a cross-border impact. The purpose is to alert authorities quickly so they can coordinate a response if needed. The early warning does not require root cause analysis or impact quantification — speed takes priority.

The incident notification must be submitted without undue delay and in any event within 72 hours of the entity becoming aware of the significant incident. This notification must update or replace the early warning with an initial assessment of the incident, including its severity and impact, and where available, the indicators of compromise. The 72-hour window aligns with GDPR's breach notification timeline, which is helpful for entities managing parallel reporting obligations. The final report must be submitted no later than one month after the incident notification. It must include a detailed description of the incident, the type of threat or root cause, the mitigation measures applied and ongoing, and where applicable, the cross-border impact of the incident.

For incidents that are still ongoing at the one-month mark, the entity must submit a progress report at that time and a final report within one month of the incident being resolved. This provision acknowledges that complex cyber incidents — particularly advanced persistent threat campaigns — may take months to fully investigate and remediate.

NIS2 places significant emphasis on cross-border incident coordination, recognising that cyber incidents rarely respect national borders. Article 23(5) requires the CSIRT or competent authority that receives a notification to determine whether the incident has cross-border relevance and, if so, to inform other affected Member States and ENISA. This coordination happens at the authority level — the entity's primary obligation is to report to its own CSIRT.

However, entities themselves have obligations related to cross-border impact assessment. The early warning (24-hour report) must indicate whether the incident could have a cross-border impact. This requires the entity to have sufficient situational awareness during the early hours of an incident to assess whether services, data, or infrastructure in other Member States are or could be affected. For entities operating pan-European networks or services, this cross-border impact assessment should be a standard element of the incident triage procedure.

The EU-CyCLONe (Cyber Crisis Liaison Organisation Network), established under Article 16, provides the large-scale incident coordination mechanism. When an incident or crisis affects multiple Member States at a level that could have systemic impact, EU-CyCLONe coordinates between national authorities, the CSIRTs network, the European Commission, and ENISA. While individual entities do not interact directly with EU-CyCLONe, they should be aware that a significant cross-border incident they report may escalate to this level — and they may receive coordination instructions or information requests through their national CSIRT as a result.

Entities with operations across the EU should integrate cross-border considerations into their incident response playbooks. This includes: maintaining an inventory of services and data processing activities by jurisdiction, pre-defining criteria for cross-border impact assessment, establishing communication channels with local IT and legal teams in each operating jurisdiction, and understanding the specific notification requirements in each Member State where the entity is established.

Building an effective NIS2 incident reporting workflow begins with the detection and triage layer. Security operations teams must be trained to escalate potential significant incidents through a defined pathway that leads to a classification decision within hours — not days. The classification decision must be made by a designated individual or team with the authority and training to apply the Article 23(3) significance criteria. This person should not be the same individual managing the technical incident response, to avoid conflicts between response priorities and reporting obligations.

The escalation pathway should be documented in the entity's incident response policy and should include clear triggers, timeframes, and handoff procedures. When an incident is detected, the SOC or IT team performs initial triage and, if it meets predefined criteria (e.g., impacts a critical service, affects personal data, involves suspected malicious activity), escalates to the designated classification authority. The classification decision must be made, documented, and communicated within a timeframe that leaves sufficient margin for preparing and submitting the 24-hour early warning.

Once an incident is classified as significant, a parallel reporting track should activate alongside the technical response track. A designated reporting officer should be responsible for compiling the early warning, liaising with the CSIRT, and managing the 72-hour notification and final report preparation. This officer should have access to the technical incident response team for information but should not be dependent on the response team's availability to prepare reports — during a major incident, the response team will be fully occupied.

Regular exercises are essential. At minimum annually, the entity should conduct a tabletop exercise that simulates a significant incident and walks through the entire reporting workflow — from detection and classification through early warning submission, CSIRT interaction, cross-border assessment, 72-hour notification, and final report preparation. The exercise should test not just the procedures but also the people, the communication channels, and the templates. Findings from these exercises must be documented and fed into the continuous improvement process for the incident response programme.