The three NIS 2 reporting deadlines
What starts each Article 23(4) deadline, what each update contains and how the platform counts them.
Article 23(4) of the NIS 2 Directive gives a significant incident three scheduled updates to the CSIRT or competent authority. The early warning and the incident notification are due without undue delay, and at the latest by their deadlines. The final report is due no later than one month after the incident notification.
The deadlines at a glance
| Update | Due under the Directive | Due in the platform | What it contains |
|---|---|---|---|
| Early warning, Article 23(4)(a) | Within 24 hours of becoming aware of the incident | 24 hours after Became aware at | Where applicable, whether the incident is suspected of being caused by unlawful or malicious acts, or could have a cross-border impact |
| Incident notification, Article 23(4)(b) | Within 72 hours of becoming aware of the incident | 72 hours after Became aware at | Where applicable, an update of the early warning and an initial assessment of the incident, including its severity and impact and, where available, the indicators of compromise |
| Final report, Article 23(4)(d) | Not later than one month after the incident notification was submitted | One calendar month after Became aware at | A detailed description, including severity and impact; the type of threat or root cause likely to have triggered it; applied and ongoing mitigation measures; and, where applicable, its cross-border impact |
How the platform counts
- All three clocks start at Became aware at. The final report's clock runs from awareness rather than from the incident notification, so it falls on or before the date the Directive allows.
- A month is a calendar month, not 30 days: an incident you became aware of on 15 March owes its final report by 15 April.
- A deadline shows as due soon in its last 8 hours and as overdue once it passes. Countdowns read, for example, 5h 20m left or Overdue 3h.
- An incident logged as Below threshold runs no clocks. Each of its updates reads "No clock — assessed below the Article 23(3) threshold".
- A clock stops when you file its update, and the update is stamped with that moment. The Filings on time figure on Reports compares it with the deadline.
Updates the platform doesn't schedule
- An intermediate report on relevant status updates, which the CSIRT or competent authority may ask for (Article 23(4)(c)). It has no fixed deadline.
- A progress report, if the incident is still ongoing when the final report is due. Article 23(4)(e) then asks for a progress report at that time and a final report within one month of your handling of the incident. The platform still shows the one-month clock.
- Telling the recipients of your services about a significant incident likely to adversely affect the provision of those services, which Article 23(1) asks of you where appropriate.
The register has no stage, clock or File button for these. If you send one, you can record it in the incident's internal notes, which only your team sees.