NIS2 Article 23 incident notification

Start with the Article 23 significance test, not with the communications template. An incident is significant when it has caused, or is capable of causing, severe operational disruption or financial loss for the entity, or when it has affected, or is capable of affecting, other natural or legal persons by causing considerable material or non-material damage.

The trigger record should capture the service affected, the time the entity became aware, the expected or actual disruption, affected recipients or third parties, financial-loss indicators, material or non-material damage indicators, and whether the incident may have cross-border impact. If the facts are still incomplete, record the uncertainty and update the assessment as the incident response team learns more.

Article 23 uses a staged reporting sequence. The early warning is due without undue delay and in any event within 24 hours of becoming aware of the significant incident. The incident notification is due without undue delay and in any event within 72 hours of awareness and should update the early warning with an initial severity and impact assessment and, where available, indicators of compromise.

After the 72-hour notification, be ready for intermediate reports when the CSIRT or competent authority requests status updates. The final report is due not later than one month after the incident notification. If the incident is still ongoing at that point, provide a progress report and then a final report within one month of handling the incident.

The authority route is not the same as customer or recipient communication. Article 23 requires notification to the CSIRT or competent authority, and where appropriate, notification to recipients of services when significant incidents are likely to adversely affect the provision of those services.

Keep separate decision owners for authority reporting, recipient communications, law-enforcement escalation, and public disclosure. Article 23 also anticipates cross-border and cross-sector cases, where single points of contact and other affected Member States may need relevant information, while preserving the entity's security, commercial interests, and confidentiality.

A useful Article 23 file shows why the team treated the event as reportable or not reportable, what the entity knew at each reporting point, and how the submitted information changed as investigation and mitigation progressed. It should be usable by incident responders during the event and by management, auditors, and regulators after the event.

For entities covered by Commission Implementing Regulation (EU) 2024/2690, align the notification file with incident-handling evidence such as incident classification, escalation records, logs, root-cause work, mitigation decisions, post-incident review, and management-body updates. ENISA guidance for that regulation describes practical advice and examples of evidence for cybersecurity requirements.

Use this checklist before an incident to make Article 23 operational, and during an incident to keep the reporting record complete. The goal is not to wait for perfect forensic certainty; it is to report the required information on time, update it as facts mature, and avoid unsupported claims.

Trust service providers need separate handling for significant incidents affecting trust services because Article 23 sets a 24-hour notification derogation for that case. Other sector-specific Union laws may also change which NIS2 provisions apply when their incident-notification requirements are at least equivalent in effect.