NIS2 Incident Reporting Pack

For significant incidents, NIS2 generally requires an early warning within 24 hours and an incident notification within 72 hours of awareness, both without undue delay. Specific exceptions apply. An intermediate report is required when the CSIRT or competent authority requests it.

The final report is generally due within one month of the incident notification. For an ongoing incident, a progress report takes its place, followed by a final report within one month of handling the incident. Check applicable national rules, sector exceptions and authority instructions. GDPR notification is a separate assessment when personal data is involved.

Use the guide and tracker to record your significance assessment, calculate candidate deadlines and prepare submission information. Check calculated dates and contact details against the applicable rules and current authority instructions before relying on them. The workbook does not make the legal reporting decision for you. Keep named decision-makers and a reference to your secure credential store ready; do not put passwords in the tracker.