NIS 2
Incident notification under NIS 2
Guide to the incident notification process according to the NIS2 Directive: discover the 3 key stages (early warning at 24h, formal notification at 72h, final report at 1 month) and their specific requirements.
Harmonised notification process
The NIS2 Directive foresees a specific incident notification process.
Stages of incident notification
-
01
Early warning
- The first stage is early warning without undue delay and no later than 24 hours after detection of the significant incident. This early warning can also be made when the impact cannot yet be defined, and the incident is potentially not significant.
- The competent authority or the CSIRT provides feedback, where possible, within 24 hours of receiving the early warning.
-
02
Formal notification of the incident
- 72 hours after detection, a formal notification of the incident is required, updating the information provided in the early warning.
- The competent authority or the CSIRT may request interim information to stay informed.
-
03
Final report
- The final report must be submitted no later than one month after the formal notification.
- If the incident has not been closed after one month, an extension of up to one month may be requested for the submission of the final report, and a progress report must be sent one month after the submission of the formal notification instead of the final report.