Report a significant incident
Log an incident as soon as you become aware of it, so the platform starts counting down the three NIS 2 Article 23(4) deadlines.
Under Article 23 of the NIS 2 Directive, a significant incident owes the CSIRT or competent authority three updates, the first two with deadlines that run from when you became aware of it. Logging the incident in Compliance › Cyber Resilience › Incidents starts the platform's clocks, so log it as soon as you know, with what you know.
Before you start
- The Incidents tab opens once Cyber Resilience is subscribed to and its Article 26(3) mandate is signed. See Open a register and Sign the mandate.
- Any member of your workspace can log an incident and file its updates, and so can a DPO assigned to your workspace.
- There is one EU-wide log and no Member State to choose. You notify one CSIRT or competent authority, which informs other affected Member States where appropriate (Article 23(6)).
- Letters a CSIRT or competent authority sends through us arrive on the Representative tab, and the Settings tab carries the representative details your Article 27 registration needs; see Letters from authorities and Publish your representative details.
Log the incident
- On the Incidents tab, select Report incident.
- Set Became aware at, in your local time. It starts at the current time, so change it if you became aware earlier. Every deadline runs from it.
- Choose a Severity: Critical, Significant, Suspected significant or Below threshold. The first three start all three clocks; Below threshold starts none. See What counts as a significant incident.
- Pick the Incident type and, if you know it, enter the Estimated users affected.
- Write the Incident summary, in at least 20 characters. Its first sentence names the incident in the register. Affected systems and Mitigation in flight are optional.
- Choose the Incident response lead: Security team, Team member, then Which member, or External vendor.
- Select Report incident.
Check before you submit. An incident can't be edited once it's logged, and that includes when you became aware and its severity.
The incident gets a reference such as NIS2-0001 and appears in the NIS2 incident register as Open.
The three deadlines
| Update | Due in the platform | Article |
|---|---|---|
| Early warning | 24 hours after you became aware | 23(4)(a) |
| Incident notification | 72 hours after you became aware | 23(4)(b) |
| Final report | One month after you became aware | 23(4)(d) |
The Directive runs the final report from the day you submit the incident notification, which is never earlier than awareness, so the platform's date for it can be earlier than the law's but never later. The Article 23 clocks board at the top of the tab lists every deadline still owed, soonest first, with a live countdown, and the deadlines also show on Home and the compliance calendar. No reminder emails are sent.
What each update contains is in The three NIS 2 reporting deadlines.
Who sends updates to the authority
You file each update on the incident; see File an update and close an incident. Filing records the update in the platform and transmits nothing. As your representative, our team reads each update you file, with its findings and any copy you attach, and submits it on the authority's portal. The platform doesn't show when an update has reached the authority.
Logging an incident or filing an update doesn't email or notify anyone, our team included. If an update is close to its deadline, email us at hello@eupresence.com as well. A deadline is for the update reaching the authority, so file each one with time to spare.