What counts as a significant incident
The Article 23(3) test, the criteria for cloud and other digital providers, and which severity to choose when you log an incident.
The reporting duties in Article 23 of the NIS 2 Directive apply to significant incidents. The severity you choose when you log an incident decides whether the platform runs the three deadlines. Not sure NIS 2 applies to you at all? Try the NIS 2 applicability checker.
The Article 23(3) test
An incident is significant if either of these is true:
- It has caused or is capable of causing severe operational disruption of the services, or financial loss, for your organisation.
- It has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.
Both tests cover incidents capable of causing that harm, not only those that already have.
Cloud and other digital providers
For DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, online marketplaces, online search engines, social networking platforms and trust service providers, Commission Implementing Regulation (EU) 2024/2690 spells out when an incident is significant. Under its Article 3, one of these is enough:
- A direct financial loss, caused or possible, of more than EUR 500,000 or 5% of your total annual turnover in the preceding financial year, whichever is lower.
- The exfiltration, caused or possible, of your trade secrets.
- The death of a person, or considerable damage to a person's health, caused or possible.
- Successful, suspectedly malicious and unauthorised access to your network and information systems that is capable of causing severe operational disruption.
- The criteria for recurring incidents in its Article 4, or those for your type of service in its Articles 5 to 14.
Scheduled interruptions of service and the planned effects of scheduled maintenance aren't significant incidents (Article 3(2)).
Choose a severity
| Severity | What the form says | Deadlines |
|---|---|---|
| Critical | Service-wide impact | All three run |
| Significant | Meets the Article 23(3) threshold | All three run |
| Suspected significant | Still being investigated | All three run |
| Below threshold | Informational only | None |
An incident logged Below threshold stays in the register as a record of your assessment. The Significant · 12 months tile counts the incidents at any of the other three severities that you became aware of in the last 12 months.
When you're not sure
Severity can't be changed once an incident is logged. If you're still assessing whether it's significant, the form's advice is to choose Suspected significant and report it now: the clocks run, and the later updates are where the picture fills in.