NIS2 Guide · 7 min
NIS2 incident reporting: the 24- and 72-hour deadlines explained
When a significant incident lands, the clock starts at once, and NIS2 measures its deadlines in hours, not days. This guide sets out what counts as a significant incident, the exact reporting sequence under Article 23, and the case teams trip over most: the moment a supplier's incident quietly becomes your reporting obligation.
Key takeaways
- A significant incident triggers a staged report: early warning within 24 hours, full notification within 72 hours, final report within one month (Art. 23).
- 'Significant' means severe operational disruption or financial loss, or considerable damage to others: not every incident clears that bar.
- A supplier or third-party incident that disrupts your service can start your 24-hour clock: visibility into them is part of readiness.
- Reports go to your national CSIRT or competent authority; you may also have to inform the recipients of your services.
What counts as a 'significant' incident
Not every incident is reportable. Under Article 23, an incident is significant if it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity, or if it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.
The Commission has set more concrete thresholds for certain digital providers in an implementing regulation, but the principle holds across sectors: judge by the severity and reach of the impact, not by how novel the attack was. When you're unsure, document the assessment: the decision not to report should be as defensible as the decision to report.
The reporting timeline (Article 23)
Reporting is staged: a fast signal first, the detail later. Every deadline runs from the moment you become aware of the significant incident: not from when it began.
Within 24 hours: early warning
A first alert to your CSIRT or competent authority, flagging whether the incident is suspected to be malicious or unlawful, and whether it could have cross-border impact.
Within 72 hours: incident notification
An update carrying an initial assessment: severity and impact, and indicators of compromise where you have them.
On request: intermediate report
If the CSIRT or authority asks, a status update on how the incident is being handled.
Within 1 month of the notification: final report
A detailed account: root cause and type of threat, the mitigations applied and still running, and any cross-border impact.
If the incident is still ongoing at the one-month mark, you file a progress report instead, with the final report due within a month of the incident being handled.
When someone else's incident becomes yours
The reporting duty doesn't stop at incidents that start in your own systems. If a supplier or service provider suffers one that significantly disrupts the services you provide, the obligation to report can land on you, and the 24-hour clock starts when you become aware, not when the supplier finally gets around to telling you.
That's the hard part: suppliers don't always disclose quickly, and a notification that arrives a week late has already eaten your deadline. So readiness rests on independent visibility: knowing when a critical supplier turns up on a ransomware leak site, has credentials dumped, or simply goes dark, without waiting for their email.
How to be ready before the clock starts
Meeting an hours-long deadline is an exercise in preparation, not heroics. Before anything happens, make sure you can answer:
Source: Directive (EU) 2022/2555 (NIS2), Article 23 — plus the Commission implementing regulation on significant-incident thresholds for certain digital providers; check your national CSIRT's reporting portal for the exact channel.
How norppa.io helps
The hardest part of the timeline is the part you don't control: a supplier incident you hear about too late. norppa.io watches your suppliers continuously (ransomware victim listings and dark-web credential leaks are re-checked roughly every six hours, with an immediate alert) so a supplier event reaches you in time to start your own clock.
And because every finding is timestamped and mapped to the NIS2 articles it answers to, the history a 72-hour notification or a one-month final report needs (what was seen, when, and what was done) is already assembled rather than reconstructed under pressure.