The 24-Hour Rule: Common Mistakes on a First NIS2 Incident Report

Article 23 requires an early warning to the competent authority or CSIRT within 24 hours of becoming aware of a significant incident. The clock starts at awareness — not at containment, not at root-cause confirmation. The early warning itself is small: whether the incident is suspected to be caused by unlawful or malicious acts, whether it could have cross-border impact, and an initial assessment if you have one. It is a signal, not a report.

Waiting for a complete picture

The most common mistake is treating the 24-hour submission as a document to be finished. Teams hold it while forensics runs, then file late with information that could have been supplied at 72 hours anyway. Everything in an early warning can be corrected in the 72-hour notification without penalty, so "we are not sure yet" is a reason to file, not to wait. Where there is genuine doubt about significance, filing and later standing down costs far less than a missed deadline.

Escalation paths and the wrong recipient

The second mistake is organisational. The 24-hour clock is consumed by internal hand-offs when nobody knows who declares an incident significant, who is authorised to submit at 02:00 on a Sunday, or how a service-desk ticket reaches that person. Name those roles, with deputies, and rehearse the path.

The third is not knowing where to file. Reporting goes to the designated authority or CSIRT of the member state where you are established, through the national channel it publishes — usually a portal that needs an account created in advance. Groups operating in several member states report in each relevant one, and where personal data is involved a separate GDPR notification to the data protection authority may also be due within 72 hours.

Plan all three stages, not just the first

Finally, teams that plan only the early warning are caught out by the 72-hour notification and the one-month final report, which do require analysis, severity assessment and mitigation detail. Decide up front who owns each stage and what evidence gets collected along the way.

← All news