Download NIS2 Checklist
Feeling lost about where to start when it comes to the NIS2 Directive? That is why we decided to equip you with actionable steps on how to kick off your compliance journey and reach full compliance with ASEE.
The official definition of an incident by NIS2 is the following:
''An incident is an event compromising the authenticity, integrity, availability or confidentiality of transmitted, stored or processed data or of the services offered by, or accessible via network and information systems.''
Since this is a broad definition, NIS2 requires only significant incidents to be reported. A significant incident is considered as ''any incident that has a significant impact on the provision of the services that important and essential entities provide'', in case:
While NIS2 specifies indicators that help determine if an incident is indeed significiant; such as the extent to which the functioning of the services is affected, the duration of the incident, and the number of affected users/recepients; there are no clear guidlines on what are considered significant financial losses and considerable material and non-material damage.
A number of companies have already received a notification about their official classification under NIS2. This means they now know whether they fall into the essential or important entity category. Entities must reach full NIS2 compliance within a year of receiving the categorization notification.
However, their incident reporting obligations start way earlier – 30 days from the date of the classification notification.
This means that all entities expecting to fall under the nis2 scope, regardless of being an important or essential entity, must have an established incident response plan.
In case you suffer a significant incident, here are the reporting steps that are in line with the NIS2 Directive:
Article 23 of the NIS2 Directive provides clear guidelines on how to accurately report significant incidents.
| NIS2 Requirement | When to report | To whom to report | Report contents | Document name |
| Notification | ASAP | Service users potentially affected by the significant incident | Inform service users about the incident and advise then to take measures in response to the threat | Significant Incident Notification for Recipients of Services |
| Early warning | Within 24 hours of knowing about the incident | CSIRT/competent authority | Point out whether the significant incident is caused by malicious acts or it could have a cross-border impact | Significant Incident Early Notification |
| Significant incident notification | Within 72 hours of knowing about the incident | CSIRT/competent authority | Initial assesment of the incident, severity and impact of the incident, indicators of compromise | Significant Incident Notification |
| Intermediate report | Upon request from CSIRT (or the competent autority) | CSIRT/competent authority | Status updates | Significant Incident Intermediate Report |
| Final report | Within one month after sending the incident notification | CSIRT/competent authority | Detailed description of the incident, including severity and impact; type of threat or root cause that likely triggered the incident; mitigation measures; if applicable, cross-border impact of the incident | Significant Incident Final Report |
| Progress report | In case the incident is ongoing a month after sending the incident notification | CSIRT/competent authority | Not specified | Significant Incident Progress Report |
The NIS2 Directive introduces stricter requirements for incident reporting that apply to both essential and important entities. Understanding what qualifies as a significant incident, knowing the reporting timeline, and being familiar with the official reporting flow are all important factors for ensuring compliance.
While the definitions may leave room for interpretation, the key takeaway is the following: entities must be proactive. With reporting obligations kicking in just 30 days after classification notification, there’s little room for delay. A well-prepared incident response plan isn’t just a recommendation - it’s a requirement.
Feeling lost about where to start when it comes to the NIS2 Directive? That is why we decided to equip you with actionable steps on how to kick off your compliance journey and reach full compliance with ASEE.
Don’t wait for a breach or a compliance deadline. Start today. Contact us for solution-specific support.
