NIS2 incident reporting: 24h, 72h and one-month deadlines

What triggers a report

The duty covers significant incidents. Under Article 23(3) of the Directive, an incident is significant if it has caused or can cause severe operational disruption of your services or financial loss, or if it has affected or can affect other people or organizations by causing considerable material or non-material damage.

For digital providers, Commission Implementing Regulation (EU) 2024/2690 sets concrete thresholds. It covers DNS providers, top-level domain registries, cloud, data center and content delivery network providers, managed service and managed security service providers, online marketplaces, search engines, social networks and trust service providers. In other sectors, national authorities may publish their own guidance.

The reporting deadlines

The first two deadlines run from the moment you become aware of the significant incident; the final report runs from the incident notification. The early warning and the incident notification are due without undue delay; the times below are the latest they may arrive. Trust service providers have a shorter deadline: for incidents affecting their trust services, the incident notification is due within 24 hours.

When	Report	What it contains
Within 24 hours of becoming aware	Early warning	Whether the incident is suspected to be caused by unlawful or malicious acts, and whether it could have a cross-border impact
Within 72 hours of becoming aware	Incident notification	An update of the early warning, an initial assessment of severity and impact, and indicators of compromise where available
On request	Intermediate report	Status updates requested by the CSIRT or the competent authority
Within one month of the notification	Final report	A detailed description with severity and impact, the type of threat or root cause, the mitigation applied and ongoing, and any cross-border impact
If the incident is still ongoing at that point	Progress report	Sent instead of the final report; the final report follows within one month of handling the incident

Telling your customers, and what you get back

The authority is not the only audience. Where appropriate, you must inform the recipients of your services without undue delay about significant incidents likely to affect the services you provide them (Article 23(1)). If a significant cyber threat could affect them, tell them what they can do to protect themselves and, where appropriate, about the threat itself (Article 23(2)).

In return, the CSIRT or competent authority replies to the early warning without undue delay, where possible within 24 hours, with initial feedback and, if you ask, guidance on mitigation (Article 23(5)).

When DORA or GDPR applies as well

Financial entities in scope of DORA, such as banks, insurers and investment firms, report major ICT-related incidents under DORA instead of NIS2, because DORA is the sector-specific law for them. Their initial notification is due as early as possible, within four hours of classifying the incident as major and no later than 24 hours after becoming aware of it. Some member states also require financial entities to send their reports to the NIS2 CSIRT.

GDPR runs in parallel. If an incident involves a personal data breach, the controller notifies the data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people’s rights and freedoms. That applies whether or not the incident is significant under NIS2. One ransomware attack can therefore mean separate reports to different authorities, on different forms.

Regime	Who it covers	First deadline	Later reports
NIS2 Directive	Essential and important entities in the EU	Early warning within 24 hours of becoming aware	Notification within 72 hours; final report within one month of the notification
DORA	Banks, insurers, investment firms and other financial entities	Initial notification within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware (if classified as major later, within 4 hours of that classification)	Intermediate report within 72 hours of the initial notification; final report within one month of the latest intermediate report
GDPR	Controllers of personal data (processors alert the controller)	Notice to the data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach	Details may follow in phases; people affected are told without undue delay if the risk to them is high
North Macedonia’s NIS2-aligned law	Public institutions and in-scope essential and important entities	First notice within 3 hours of becoming aware	Early warning at 24 hours, notification at 72 hours, final report one month after the notification

National laws decide the details

NIS2 is a directive, so each member state writes it into its own law. It sets minimum rules, which means a national law can be stricter, and the national law decides which CSIRT or authority receives your reports, which portal and forms to use, and how significance is judged in sectors without EU-level thresholds.

For some digital providers, including cloud, data center and managed security service providers, the competent authority is in the member state of their main establishment in the EU (Article 26). If your group operates in several countries, map which law applies to each entity and keep every contact point and portal in your incident playbook. Outside the EU, North Macedonia has aligned its law with NIS2 and adds a first notice within three hours.

Prepare before the clock starts

Name who decides that an incident is significant, and give that person a deputy for nights, weekends and holidays.
Keep the reporting portal, the CSIRT contact and the forms for every country you operate in inside your incident playbook.
Record the moment you became aware of the incident: the early warning and the notification are counted from it.
Keep a running case timeline of what was detected, decided and done. It is the raw material for the 72-hour notification and the final report.
Collect indicators of compromise as you go, because the incident notification asks for them where available.
Decide in advance how you will tell customers whose services are affected.
Check whether the same incident also triggers GDPR or DORA reporting, and agree who files each report.

How we help

Managed SOC 24/7: Round-the-clock monitoring, detection and response across EMEA, with AI-assisted triage and analysts who make the final call.

Learn more Book a consultation

Frequently asked questions

When does the 24-hour clock start?

When you become aware of the significant incident, not when the attack began. Record that moment in the case file, because the early warning and the incident notification are both counted from it.

Do we report to the EU or to a national authority?

To a national one. Each member state names the CSIRTs and competent authorities that receive reports, usually through a national portal. For some digital providers, the competent authority is in the member state of their main establishment in the EU.

Do banks report under NIS2 or DORA?

Under DORA. For financial entities in its scope, DORA is the sector-specific law, and its incident reporting rules apply in place of those in NIS2. Some member states also ask them to send a copy of each report to the CSIRT designated under NIS2.

Can a managed SOC file the reports for us?

Under NIS2 the duty stays with your organization, and a SOC can prepare the reports for you. Under DORA a financial entity may outsource the reporting itself but remains fully responsible for it (Article 19(5)). Either way, a SOC case timeline gives you the facts each report needs: when the incident was detected, what was affected, the indicators of compromise and the actions taken.

NIS2 incident reporting in the EU: deadlines, overlaps and preparation