NIS2 guide

NIS2 incident reporting: 24 hours, 72 hours, one month

Under NIS2, essential and important entities must report every significant incident to their national CSIRT or, where the national law says so, to their competent authority (Article 23(1)). The report comes in stages: an early warning within 24 hours, an incident notification within 72 hours, and a final report within a month.

This guide covers what makes an incident significant, when the clock starts, what goes in each notice, and who else you may need to tell.

Last checked 3 November 2026 against the Directive's text on EUR-Lex. Your national law names the authority, the reporting channel and any forms. This is general information, not legal advice.

1. The timeline

Article 23(4) sets these stages. Each deadline is a maximum: the Directive says "without undue delay and in any event within" the time shown.

When	What you send
24 hours	Early warning, counted from when you became aware of the significant incident.
72 hours	Incident notification, also counted from when you became aware.
On request	Intermediate report on relevant status updates, if the CSIRT or authority asks for one.
One month	Final report, no later than one month after the incident notification.
If ongoing	If the incident is still going on when the final report is due, a progress report then, and the final report within one month of when you finish handling the incident.

Trust service providers have a shorter deadline. For significant incidents that affect their trust services, the incident notification is due within 24 hours (Article 23(4), last subparagraph).

The CSIRT or authority must reply to the early warning without undue delay and, where possible, within 24 hours, with initial feedback. If you ask, it also gives guidance or operational advice on possible mitigation measures (Article 23(5)).

2. What makes an incident significant

An incident is any event that compromises the availability, authenticity, integrity or confidentiality of data, or of the services your systems provide (Article 6, point 6). It is significant if (Article 23(3)):

it "has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned"; or
it "has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage".

Note the words "capable of". An incident can be significant before any harm is done. Recital 101 lists what an initial assessment should look at: the systems affected and how important they are to your services, how severe the threat is, any weaknesses being exploited, and your experience with similar incidents. It also names useful indicators: how far the service is affected, for how long, and how many users are affected.

Some digital providers have fixed thresholds. For DNS, top-level domain, cloud, data centre, content delivery network, managed service, managed security service, online marketplace, search engine, social network and trust service providers, Implementing Regulation (EU) 2024/2690 says an incident is significant if, among other cases (Article 3):

it causes, or could cause, a direct financial loss above €500,000 or 5% of annual turnover, whichever is lower;
trade secrets are, or could be, stolen;
it causes, or could cause, someone's death or considerable damage to someone's health;
someone has gained unauthorised access to systems, the access is suspected to be malicious, and it could cause severe disruption.

The Regulation adds thresholds for each type of service (Articles 5 to 14). It also treats incidents that happen at least twice in six months with the same apparent root cause as one significant incident, if together they meet the financial loss threshold (Article 4). Planned maintenance does not count (Article 3(2)).

3. When the clock starts

The 24 and 72 hours run from when you become aware of the significant incident. The Directive does not define "becoming aware". For the digital providers above, recital 31 of Implementing Regulation 2024/2690 explains it. When you detect something suspicious, or someone tells you about it, you should assess it promptly. You become aware when that first assessment gives you "a reasonable degree of certainty that a significant incident has occurred". For other sectors, look for your national authority's guidance.

The early warning is meant to be short. Recital 102 says it should only include the information needed to make the CSIRT aware and to let you ask for help. Reporting should not take people away from handling the incident.

4. What goes in each notice

The required contents come from Article 23(4). The "also useful" lines are our suggestions for what an authority usually needs to act. Your national form may ask for more.

Early warning (24 hours)

Required, where applicable: whether you suspect the incident was caused by unlawful or malicious acts, and whether it could have a cross-border impact.
Also useful: your organisation's name and sector, a contact who can be reached, when you became aware, which services are affected, and whether you want help.

Incident notification (72 hours)

Required, where applicable: an update to the early warning, and an initial assessment of the incident, including its severity and impact.
Required where available: indicators of compromise, such as malicious IP addresses, domains or file hashes.
Also useful: what you have done so far to contain it, and the number of users or customers affected.

Final report (one month after the notification)

a detailed description of the incident, including its severity and impact;
the type of threat or root cause that is likely to have triggered it;
the mitigation measures applied and still in progress;
where applicable, its cross-border impact.

Also useful in the final report: the lessons learned and the changes you are making as a result.

5. Telling your customers

Significant incidents. Where appropriate, you must also tell the recipients of your services, without undue delay, about significant incidents that are likely to affect the services you provide them (Article 23(1)).
Significant cyber threats. Where applicable, you must tell recipients who may be affected by a significant cyber threat what they can do about it. Where appropriate, you also tell them about the threat itself (Article 23(2)).
The public. After consulting you, the CSIRT or authority may inform the public, or require you to, when that is needed to prevent or deal with an incident, or is otherwise in the public interest (Article 23(7)).

Reporting does not count against you: "The mere act of notification shall not subject the notifying entity to increased liability" (Article 23(1)).

A NIS2 report does not replace other duties. If the incident is also a personal data breach, GDPR Article 33 applies separately. You notify your data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to people's rights and freedoms. That is a different authority, and the test is different too.

If the incident looks criminal, the CSIRT or authority also gives guidance on reporting it to the police (Article 23(5)). Your contracts may require you to tell some customers within a set time as well.

If your business is outside NIS2, you have no duty to report under it, but you may still report a significant incident, cyber threat or near miss to the CSIRT on a voluntary basis (Article 30). Your NIS2 customers may also ask you, under contract, to tell them quickly about incidents that affect them, so that they can meet their own deadlines.

7. Get ready now

Twenty-four hours goes quickly during an incident. These steps are worth doing in advance:

Find your CSIRT or competent authority and its reporting channel, and put them in your incident response plan.
Name who decides whether an incident is significant, who sends the notices, and their deputies.
Pre-fill your organisation's details: name, sector, contacts, services and the countries you serve.
Prepare a template for each notice, and one for telling customers.
Add the GDPR decision to the same plan, so both questions are asked together.
Rehearse with a short tabletop exercise each year.

Our NIS2 Small-Entity Compliance Kit includes pre-written templates for the early warning, the incident notification, the final report and the notice to the people who use your services. It also has an incident response plan with a NIS2 and GDPR decision tree and a tabletop exercise.

8. Sources

Directive (EU) 2022/2555 (NIS2), EUR-Lex: Articles 6, 23 and 30, recitals 101 and 102.
Commission Implementing Regulation (EU) 2024/2690, EUR-Lex: Articles 3 and 4, recital 31.
Regulation (EU) 2016/679 (GDPR), EUR-Lex: Article 33.