NIS2 Incident Handling

NIS 2 mandates a three-stage reporting regime: (1) Early warning within

24 hours of becoming aware of a significant incident, speed takes precedence over completeness at this stage. (2) Full notification within

72 hours with initial assessment, affected systems and damage potential. (3) Final report no later than one month after initial notification with complete analysis, measures taken, and lessons learned.

A security incident is reportable under NIS 2 when it is significant: it causes severe operational disruptions, considerable financial losses, or has systemic effects on other entities or sectors. Assessment criteria include: number of affected users, downtime duration, geographic scope, and economic damage. When in doubt: report early rather than late, early warnings do not need to be complete.

In Germany, essential and important entities report significant security incidents to the BSI (Federal Office for Information Security) via the BSI-Portal (Melde- und Informationsportal/MIP). Financial companies additionally report to BaFin. The BSI coordinates cross-border incidents with the European CSIRT network. Incidents must be filed even before full forensic analysis is complete.

A NIS2-compliant incident handling system must include: structured detection processes (monitoring, SIEM), documented escalation paths, defined incident response roles, procedures for initial severity assessment, BSI notification protocols, containment and recovery procedures, and post-incident review for lessons learned. All steps must be traceable through documentation.

NIS 2 and GDPR have overlapping but distinct reporting obligations: GDPR (Art. 33) requires notification to the data protection authority for personal data breaches within

72 hours. NIS 2 requires notification to the BSI for significant security incidents, even when no personal data is affected. A cyberattack involving a data breach can trigger both obligations simultaneously. Organizations must prepare parallel notification workflows.

Common mistakes: (1) Classifying incidents as non-significant too late, downplaying internally until the 24h deadline has passed. (2) No notification playbook, staff do not know what to report where and when. (3) Incomplete documentation, no audit trails for the final report. (4) Forgetting the parallel GDPR notification obligation. (5) No exercises, processes are tested for the first time during an actual incident.