Under NIS2 Article 23, an essential or important entity must send an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report no later than one month after that notification. The clock starts at awareness, not at the end of your investigation.
The four report types
Article 23(4) sets out the sequence. The recipient is your national CSIRT or competent authority.
- Early warning, within 24 hours. Say whether you suspect unlawful or malicious acts and whether the incident could have cross-border impact. Keep it short.
- Incident notification, within 72 hours. Update the early warning and add an initial assessment, including severity, impact and, where available, indicators of compromise.
- Intermediate report, on request. Status updates when the CSIRT or authority asks for them.
- Final report, within one month of the notification. A detailed description, the likely root cause or threat type, mitigation applied and ongoing, and any cross-border impact.
If the incident is still ongoing when the final report falls due, Article 23(4)(e) asks for a progress report then and a final report within one month of handling the incident.
Two other duties people forget
Entities must also tell affected service recipients without undue delay where appropriate, and communicate to recipients any measures they can take against a significant cyber threat (Article 23(1) and (2)). Trust service providers have a shorter window: 24 hours for the notification in place of 72.
The text also says that the mere act of notification does not make the notifying entity more liable.
What response the authority owes you
Article 23(5) says the CSIRT or authority should respond, where possible within 24 hours of the early warning, with initial feedback and, if asked, guidance on mitigation. If the incident looks criminal, they should also advise on reporting to law enforcement.
Build the process before the incident
Teams that struggle usually have not decided who can declare an incident "significant". A workable setup:
- Write the significance criteria into your incident runbook (see what counts as a significant incident).
- Name one person who files and one backup.
- Keep a template for each report type, with fields ready for timestamps and indicators.
- Record the moment of awareness in your ticket. You will need to show it.
- Rehearse once a year with a tabletop that includes drafting the 24 hour message.
Member states may add national forms or portals, so check where your authority expects the filing.
Safeguard's compliance and evidence automation can help keep incident records and related evidence in one place, though the legal assessment of significance stays with you.
Quick check
Does the 24 hours start when the attack began?
No. Article 23(4)(a) counts from when the entity "becomes aware" of the significant incident.
Do near misses have to be reported?
Not under Article 23. Article 30 allows voluntary notification of incidents, cyber threats and near misses.
Sources
Last reviewed: 19 October 2026.
