#The reporting cascade
| Report | Deadline | Content |
|---|---|---|
| Early warning | Without undue delay, within 24 hours of becoming aware of a significant incident | Whether it is suspected to be unlawful or malicious; whether it could have cross-border impact |
| Incident notification | Within 72 hours of becoming aware | Updates the early warning; initial assessment of severity and impact; indicators of compromise where available |
| Intermediate report | On request of the CSIRT or competent authority | Relevant status updates |
| Final report | Within one month of the incident notification | Detailed description, type of threat or root cause, mitigations applied, cross-border impact |
| Progress report | If the incident is ongoing at the final-report deadline | Status, with a final report within one month of handling the incident |
Trust service providers must submit the incident notification within 24 hours rather than 72 [1].
#Who is in scope
NIS2 applies to medium and large entities in sectors listed as essential or important — including energy, transport, banking, health, digital infrastructure, ICT service management, and a range of manufacturing and digital providers — plus some entities regardless of size. Member states had to transpose the directive by 17 October 2024, and national laws differ in detail, including which authority or CSIRT receives reports. Confirm the receiving body in each country where you operate before you need it.
#Designing for the 24-hour report
- Define "significant incident" criteria in advance (Article 23(3): severe operational disruption or financial loss, or considerable damage to others).
- Pre-approve the early-warning template and who can send it at 3 a.m.
- Collect IoCs from the first hour; the 72-hour report expects them.
- Keep one timeline as the source for every report, so the one-month report doesn't contradict the first.
#Sources
Talk to an operator.
Thirty minutes, no slides. We'll show you what bad AI finds in one of your systems.
Book a briefing