What are the incident reporting requirements under NIS2?

Overview of NIS2 Incident Reporting

The NIS2 Directive introduces strict incident reporting obligations designed to enhance coordinated response to cybersecurity threats across the EU. Organizations must report significant incidents through a structured three-stage process with specific timelines.

What Constitutes a Significant Incident?

Before diving into reporting requirements, it's essential to understand what must be reported. A significant incident is one that:

• Has caused or is capable of causing severe operational disruption of the services or financial loss for the entity
• Has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage

Examples of Significant Incidents

• Ransomware attacks that disrupt operations
• Major data breaches affecting customer information
• Successful phishing attacks compromising critical systems
• Distributed Denial of Service (DDoS) attacks disrupting services
• Supply chain attacks affecting your organization
• System compromises that could impact other entities

What Doesn't Require Reporting

• Minor technical glitches without security implications
• Attempted attacks that were successfully blocked
• Incidents with negligible impact
• Routine security events handled by standard procedures

However, when in doubt, it's better to err on the side of reporting. National authorities prefer early notification of potential incidents over missed reporting of significant events.

The Three-Stage Reporting Process

Stage 1: Early Warning (Within 24 Hours)

Timeline: Without undue delay and at the latest within 24 hours of becoming aware of the significant incident.

Who to Notify: Your national competent authority or the national Computer Security Incident Response Team (CSIRT), depending on your member state's structure.

Required Information:

• Basic incident details (what happened, when you became aware)
• Whether the incident was caused by unlawful or malicious acts
• Whether the incident is suspected to have a cross-border impact
• Initial assessment of severity (if available)

Purpose: This early warning allows authorities to:

• Prepare coordinated responses
• Alert other potentially affected entities
• Begin tracking patterns of attacks
• Mobilize resources if needed

Practical Note: You may not have complete information at this stage. Provide what you know and indicate what's still under investigation. The goal is rapid communication, not comprehensive analysis.

Stage 2: Incident Notification (Within 72 Hours)

Timeline: Without undue delay and at the latest within 72 hours of becoming aware of the significant incident.

Required Information:

• Update on information provided in the early warning
• Initial assessment of the incident's severity and impact
• Indicators of compromise (IoCs), where available
• Estimated scope of the incident
• Potentially affected systems and data

Additional Details to Include:

• Type of threat or suspected threat actor
• Attack vectors used
• Systems and services affected
• Number of users or customers impacted
• Current status of the incident
• Initial response actions taken

Purpose: This notification provides authorities with enough information to:

• Assess the broader threat landscape
• Share indicators of compromise with other entities
• Determine if coordinated response is needed
• Evaluate potential regulatory action

Stage 3: Final Report (Within One Month)

Timeline: No later than one month after the incident notification (i.e., within one month of the 72-hour report).

Required Information:

• Comprehensive description of the incident
• Detailed assessment of severity and impact
• Type of threat or root cause that triggered the incident
• Applied mitigation measures
• Ongoing mitigation measures
• Cross-border impact analysis
• Lessons learned
• Recommendations for prevention

Additional Details to Include:

• Timeline of the incident from initial compromise to containment
• Complete list of affected systems, data, and services
• Number and types of affected individuals or entities
• Estimated financial impact
• Remediation costs
• Changes to security measures implemented as a result
• Assessment of residual risk

Purpose: This final report allows authorities to:

• Close the incident case
• Analyze trends and patterns
• Share detailed threat intelligence
• Assess the entity's response and recovery capabilities
• Determine if any follow-up actions are necessary

Calculation of Deadlines

"Becoming Aware" is the critical trigger point for all reporting deadlines. You become aware when:

• Your security systems detect the incident
• You're notified by a third party (customer, partner, researcher)
• You discover the incident during routine operations
• You're informed by authorities

The clock starts from this awareness point, not from when the incident actually occurred.

Example Timeline

Day 0, 10:00 AM: Your security team detects unusual network activity Day 0, 3:00 PM: Investigation confirms it's a significant incident (ransomware)

Deadline calculations start from 10:00 AM on Day 0:

• Early Warning: By 10:00 AM on Day 1 (24 hours)
• Incident Notification: By 10:00 AM on Day 3 (72 hours)
• Final Report: By Day 30 (one month from Day 3)

Reporting Channels

Each EU member state designates specific reporting channels:

National CSIRT

• Technical point of contact
• Receives incident notifications
• Provides technical assistance
• Coordinates with other CSIRTs

Competent Authority

• Regulatory oversight body
• May receive reports depending on national rules
• Enforces compliance
• Imposes penalties if necessary

Single Point of Contact (SPOC)

• Some member states designate a single point of contact
• Streamlines reporting process
• Coordinates between different authorities

Check your member state's specific requirements, as reporting channels vary.

Cross-Border Incidents

If an incident has or may have cross-border impact:

• Indicate this in the early warning (24-hour report)
• Provide details on which other member states may be affected
• Your national authority will coordinate with other EU member states
• You may be asked to provide additional information for cross-border coordination

Cross-border coordination is handled at the authority level, so you don't need to report to multiple member states yourself.

Reporting Format and Systems

Technical Requirements

• Most member states provide electronic reporting portals
• Some accept email reports as a backup
• Specific templates may be provided
• Secure channels are typically required

Information Security

• Use secure communication channels
• Encrypt sensitive information
• Follow your member state's technical requirements
• Protect confidential business information while meeting reporting obligations

Consequences of Non-Compliance

Failure to meet incident reporting requirements can result in:

For Essential Entities

• Fines up to €10 million or 2% of global annual turnover (whichever is higher)
• Reputational damage
• Increased regulatory scrutiny
• Mandatory audits

For Important Entities

• Fines up to €7 million or 1.4% of global annual turnover (whichever is higher)
• Similar non-monetary consequences

Specific Reporting Violations

• Failure to report within deadlines
• Providing incomplete or inaccurate information
• Failure to update reports as new information becomes available
• Not reporting incidents that meet the significance threshold

Best Practices for Compliance

Before an Incident

1. Establish Clear Procedures

   • Document incident reporting procedures
   • Assign roles and responsibilities
   • Identify who can authorize reporting
   • Create reporting templates

2. Know Your Contacts

   • Identify your national CSIRT
   • Save contact details for competent authorities
   • Understand reporting portal access procedures
   • Establish escalation paths

3. Define Significance Criteria

   • Create internal criteria for what constitutes a significant incident
   • Train staff to recognize reportable incidents
   • Establish rapid assessment procedures
   • Document decision-making processes

4. Test Your Process

   • Conduct tabletop exercises
   • Practice reporting procedures
   • Ensure systems and access are working
   • Update procedures based on lessons learned

During an Incident

1. Start the Clock

   • Document when you became aware
   • Begin incident assessment immediately
   • Notify relevant internal stakeholders
   • Prepare for potential reporting

2. Parallel Investigation and Reporting

   • Don't wait for complete information before reporting
   • Report what you know within deadlines
   • Continue investigation while preparing reports
   • Update reports as new information emerges

3. Maintain Records

   • Document all actions taken
   • Record timeline of events
   • Save evidence and indicators of compromise
   • Keep copies of all reports submitted

After an Incident

1. Complete Final Report

   • Conduct thorough post-incident analysis
   • Document lessons learned
   • Describe improvements implemented
   • Submit comprehensive final report

2. Review and Improve

   • Assess your reporting process effectiveness
   • Update procedures based on experience
   • Train staff on any procedural changes
   • Prepare for future incidents

Integration with Existing Frameworks

NIS2 incident reporting should be integrated with:

• GDPR breach notification (if personal data is involved)
• Sector-specific reporting (banking, energy, healthcare regulations)
• ISO 27001 incident management (if certified)
• Internal incident response procedures

Coordinate these different reporting obligations to ensure consistency and avoid duplicative work.

NIS2's incident reporting requirements represent a significant compliance obligation, but they serve an important purpose: creating EU-wide visibility into the cybersecurity threat landscape. By following the three-stage reporting process, meeting deadlines, and providing accurate information, organizations contribute to collective security while fulfilling their legal obligations.

Preparation is key. Establish clear procedures now, before an incident occurs. Know your reporting channels, understand the timelines, and ensure your team is trained. When a significant incident happens, you'll be ready to meet your reporting obligations while focusing on containment and recovery.