NIS2 incident notification: what must be reported at 24 hours, 72 hours and 1 month?
·
By 
Bertrand Bucelle · 5 min read
What is a 'significant incident'?
Not everything needs to be notified. Article 23, paragraph 3, qualifies as significant an incident that:
- has caused or is capable of causing a severe operational disruption to services or financial losses for the entity; or
- has affected or is capable of affecting other natural or legal persons by causing considerable material, physical or moral damage.
Ransomware that encrypts production, prolonged unavailability of an essential service, a compromise that exposes customer data fall within the definition. An isolated workstation reinstalled within an hour does not. The qualification must be made quickly, by a designated person, according to criteria written in advance: this is the first test of your procedure. When in doubt about the threshold, notifying is the safe option, the early warning being precisely designed to be issued in a situation of uncertainty.
The three deadlines, content by content
| Deadline | Document | Expected content |
|---|---|---|
| 24 hours after becoming aware | Early warning | Incident report; specify whether an unlawful or malicious origin is suspected and whether a cross-border impact is possible |
| 72 hours | Incident notification | Update of the alert: initial assessment of the incident (severity, impact), available indicators of compromise |
| Upon request by the authority | Interim report | Status of incident management |
| 1 month after notification | Final report | Detailed description (severity, impact), type of threat and likely root cause, mitigation measures applied and ongoing, cross-border impact where applicable |
If the incident is still ongoing at the deadline for the final report, the entity submits a progress report, then the final report within one month following the effective handling of the incident. The early warning is not an admission: it also triggers assistance from the CSIRT, which must respond within 24 hours with initial guidance.
Who else to notify in addition to the authority?
- The recipients of your services: when a significant cyber threat is likely to affect them, Article 23(2) requires that you communicate to them the measures and remedies they can apply, and where applicable the threat itself.
- The French data protection authority (CNIL) and the data subjects if the incident involves a personal data breach: notification to CNIL within 72 hours (Article 33 of the GDPR) and communication to individuals in case of high risk (Article 34). Both clocks run in parallel, not one after the other.
- Your regulated customers if you are a provider: your contracts now include notification clauses, often shorter than the law (see the processors article).
- The cyber insurer, according to the policy, on pain of loss of coverage.
The internal framework that makes the deadlines achievable
Twenty-four hours is tight on a Saturday night. Five elements make the difference:
- A designated decision-maker (and their deputy) empowered to qualify the incident and trigger notification, reachable on call.
- Written qualification criteria with examples specific to your activity, reviewed annually.
- Pre-filled templates for early warning and notification: in a crisis, you complete a form, you don't draft one.
- A time-stamped incident log from detection onwards: it feeds the three deadlines and protects the executive (see their liability).
- An annual exercise including a dry-run notification: it's the crisis management requirement of Article 21, and the only way to know whether the chain holds under real conditions.
The five costly mistakes
- Waiting to understand everything: early warning is based on available information; detail comes at 72 hours and in the final report.
- Confusing a NIS2 incident with a GDPR breach: the scopes overlap without being identical; sabotage without personal data is notified to the French cybersecurity agency (ANSSI), not the French data protection authority (CNIL), and conversely an HR file leak may not be a significant NIS2 incident.
- Notifying without informing management: the management body oversees risk management; keeping it in the dark weakens its legal position.
- Neglecting customers: the obligation to inform recipients is autonomous and forgetting it is paid for in contractual litigation.
- Not closing out: the final report at 1 month is the one we forget; set an automatic deadline in the incident management tool.
Take action
Manage your compliance with Data Comply One: all-in-one software and outsourced DPO/CISO experts.
Discover the NIS2 software →Test my NIS2 compliance →Sources
- Directive (EU) 2022/2555 (NIS2), Article 23 (and Article 30 on voluntary notification), EUR-Lex.
- Regulation (EU) 2016/679 (GDPR), Articles 33 and 34, EUR-Lex.
- The French cybersecurity agency (ANSSI), MesServicesCyber and CERT-FR: assistance and incident reporting.