File an update and close an incident

The File button appears only on the next update the incident owes, so the three are filed in order.

1. Select File on that update.
2. Write the Findings, in at least 10 characters: what is known now, what has changed since the last update and what has been done. Include any cross-border impact, which the early warning and the final report both ask about (Article 23(4)(a) and (d) of the NIS 2 Directive).
3. Under The report you filed (optional), add the update as it goes to the authority: a PDF, plain text, PNG or JPEG file under 25 MB.
4. Select Record as filed.

The update shows Filed with today's date and your name, and its clock stops. Filing records the update in the platform; our team submits it on the authority's portal, as explained in Report a significant incident.

Each filed update has a Copy of the update row. Select Attach copy if you filed without one, Replace to put a newer file under the same link, or Remove to delete the file. Removing it takes the file out of Documents and storage but leaves the update filed with its findings. Copies are listed in Documents as incident reports, and you can attach or replace one after the incident is resolved.

Under Internal notes, select Add note, write it and select Post note. A note carries your name and the time, can't be edited, and is visible only to your team: our team's view of the incident doesn't include notes. The audit log records that a note was added, not what it says. You can add notes after the incident is resolved.

When the incident is handled, select Mark resolved at the foot of the drawer. Write the Findings, in at least 10 characters, on what was found and how the incident was contained, then select Mark resolved in the dialog. The incident becomes Resolved and owes no further update in the platform: any update not yet filed stops counting and can no longer be filed.

To close several at once, tick open incidents in the register and select Resolve in the bar that appears; the button shows how many you ticked. Describe How these were handled once, and it's recorded on each of them.