Start with Scope and Significance
Article 23 of the NIS2 Directive sets a reporting framework for significant incidents affecting covered entities. For a particular organisation, confirm the applicable national implementation, sector-specific rules and competent reporting route. The directive is not a blanket instruction that every SME must notify the same CSIRT after any security alert.
The timing is linked to awareness of a significant incident. An alert, the moment an attack began and the moment the significance is established are not necessarily identical. Record the timeline and the information available at each decision; do not delay escalation while waiting for a complete investigation.
What Makes an Incident Significant?
Article 23(3) concerns incidents that cause or are capable of causing severe operational disruption or financial loss, or considerable material or non-material damage to other people or organisations. Further rules can specify significance for particular types of entity. Assess affected services, impact, duration and the applicable thresholds.
The Directive’s Reporting Sequence
| Step | Timing in Article 23(4) | Main purpose |
|---|---|---|
| Early warning | Without undue delay, within 24 hours of awareness of the significant incident | Indicate suspected unlawful or malicious action and possible cross-border impact |
| Incident notification | Without undue delay, within 72 hours of that awareness, subject to the special rule for trust service providers | Update the warning and give an initial severity/impact assessment, including available indicators of compromise |
| Intermediate report | At the request of the competent CSIRT or authority | Provide relevant status updates |
| Final report | Within one month after the incident notification | Describe the incident, likely cause, mitigation and relevant cross-border impact |
| Ongoing incident | A progress report at the final-report stage, followed by the final report within one month after handling concludes | Keep the authority informed while response continues |
These steps appear in points (a)–(e) of Article 23(4). The special notification rule for trust service providers and any applicable sectoral or national provisions must be checked separately. A response plan should not assume that weekends or internal approval delays suspend a reporting period.
Communication with Service Recipients
Article 23 also addresses communication to recipients where appropriate when a significant incident is likely to affect services adversely, and communication about significant cyber threats and protective measures. Distinguish these situations from authority reporting. Explain confirmed impact and useful actions; avoid presenting an unverified cause as established fact.
A personal-data breach may separately trigger GDPR obligations. Meeting one reporting requirement does not automatically satisfy another.
Prepare the Reporting Route Before an Incident
Identify the competent CSIRT or authority for the entity and keep current reporting instructions, emergency contacts and authorised substitutes. Poland’s national cybersecurity arrangements include CSIRT NASK, CSIRT GOV and CSIRT MON, alongside relevant sectoral arrangements; the correct route depends on the entity and applicable rules. Do not assume NASK is the statutory recipient for every business.
An Operational Playbook
- Capture the signal. Record the alert, time, affected service and available evidence.
- Triage and escalate. Assess significance using the applicable criteria and involve the responsible security and legal/privacy roles.
- Record the decision. Keep the facts, uncertainties, owner and reasons for reporting or not reporting.
- Contain and communicate. Protect affected systems while preserving necessary evidence. Send required initial reports without waiting for a complete root-cause analysis.
- Update and recover. Track changes in scope, recovery and communications. Prepare interim, final or progress reports as required.
- Learn from the event. Assign improvements, test recovery and update the playbook.
Logs and Rehearsal
Choose logging and retention based on operational need, legal obligations, data protection and the sensitivity of the records. NIS2 does not prescribe a universal six-month or twelve-month retention period for every application log.
Test the playbook with a realistic exercise. Check that the decision-maker can be reached, records are available when normal systems are down, and a substitute can prepare a report. An exercise provides evidence of readiness; it does not certify the organisation’s compliance.
From the Inventory to an Implementation Plan
Q-Journey includes AiP Express and Platinum, with Lean and Muda consulting in Platinum. The agreed project scope determines which processes and technical gaps are examined. A technical review does not itself certify legal compliance; legal classification and any required assessment need the appropriate accountable specialists.
Primary Sources
NIS2 Directive (EU) 2022/2555, especially Articles 20–23; GDPR; and the AI Act. Check the current national implementation, competent authority and any sector-specific rules for the organisation concerned.
GLOSSARY
Terms in this article
Clear explanations of the terms you may want to revisit.
Explore the glossary