NIS-2
NIS-2 reporting obligations: what to do in an incident
A security incident is always an exceptional situation. Under NIS-2 there is an additional challenge: significant incidents must be reported to the competent authority, in Germany the BSI, in a fixed multi-stage procedure.
The deadlines at a glance
- Early warning within 24 hours of becoming aware of the incident, with an initial assessment of whether unlawful or malicious activity is suspected.
- Incident notification within 72 hours with an assessment of severity, impact and, where available, indicators of compromise.
- Final report after one month with the root cause, the measures taken and any cross-border impact.
When is an incident significant?
An incident is significant if it has caused or can cause severe operational disruption or financial loss, or considerable damage to other persons. This assessment has to be made quickly, so criteria should be defined in advance.
Preparation is everything
Anyone who only thinks about who reports and which information is needed once an incident occurs loses valuable hours. Proven measures include:
- a documented incident response process with clear roles
- prepared reporting templates and contact channels
- central logging so causes can be traced
- regular exercises, for example as a tabletop scenario
Interface with the GDPR
If personal data is affected, the GDPR obligation to notify the data protection authority within 72 hours also applies. Both processes should be aligned so that no notification is forgotten and information stays consistent.
A well-practised reporting process not only reduces liability risk but also shortens the time until operations are restored.