NIS2 Reporting Requirements: 24h and 72h Incident Notification

NIS 2 reporting requirements obligate essential and important entities to promptly notify the competent national authority of significant cybersecurity incidents. Notification follows a three-stage process: early warning within

24 hours, incident notification within

72 hours, and final report within one month. The purpose is to enable rapid authority response, coordinate reactions, and warn other potentially affected entities. In Germany, reports go to the BSI.

NIS 2 sets three reporting deadlines: 1. Early warning within

24 hours of becoming aware of a significant incident, contains basic information and initial assessment. 2. Incident notification within

72 hours, includes initial evaluation, severity assessment, indicators of compromise, and measures taken. 3. Final report within one month, complete analysis, root cause, remediation measures, and lessons learned. For ongoing incidents, an interim progress report may be requested by the authority.

Significant cybersecurity incidents are reportable. An incident is considered significant if it causes or could cause: significant disruption to the provision of the service, significant financial losses to the entity affected, or significant material or non-material damage to other natural or legal persons. ENISA and national authorities have published guidance on thresholds. Even incidents without confirmed impact must be reported if there is reasonable suspicion of significance.

In Germany, NIS 2 incidents are reported to the BSI using its dedicated reporting portal. Financial entities under DORA additionally report to BaFin. For organizations in other EU member states, the competent national Computer Security Incident Response Team or national authority is the reporting recipient. The BSI forwards relevant threat intelligence to ENISA and coordinates with other affected member states where cross-border impact is identified.

Violations of NIS 2 reporting obligations can have serious consequences: fines for essential entities up to EUR

10 million or 2% of global annual turnover, and for important entities up to EUR

7 million or 1.4% of annual turnover. Authorities can also issue binding remediation orders, impose temporary service suspension, and in serious cases pursue personal liability of management. Prompt and transparent reporting can be considered a mitigating factor in enforcement proceedings.

NIS 2 reporting obligations and GDPR reporting obligations can be triggered simultaneously when a cyber incident also involves personal data. GDPR Article

33 requires notification of data breaches to the supervisory authority within

72 hours. NIS 2 requires three-stage incident reporting to the cybersecurity authority within 24h, 72h, and one month. Both obligations apply separately and are directed at different authorities. Organizations should build integrated incident response processes that simultaneously address both regulatory frameworks.