EU NIS2 Directive 24-hour early warning

Under NIS2 Article 23, essential and important entities notify their CSIRT or competent authority of significant incidents. The first required step is an early warning submitted without undue delay and, in any event, within 24 hours of becoming aware of the significant incident.

The early warning is not the full incident report. It must indicate, where applicable, whether unlawful or malicious acts are suspected or whether the incident could have a cross-border impact. The 72-hour incident notification supplies the initial severity and impact assessment and available indicators of compromise. For trust service providers, that incident notification is due within 24 hours when the significant incident affects trust services.

The evidence file should prove the significance decision and the timing. Keep the detection record, initial assessment, awareness timestamp, affected services, notification route, warning payload, submission receipt, and escalation approvals together. Preserve facts that were uncertain at submission instead of silently replacing the first assessment later.

Do not wait for the final root cause before sending the early warning. Article 23 expects a staged process: early warning, 72-hour incident notification, intermediate reports if requested, and a final report after the incident notification or after handling a continuing incident.

Awareness, significance, and routing often require separate decisions. Determine when the entity had enough information to conclude that Article 23(3), applicable national criteria, or binding sector-specific criteria were met; then identify the correct national route and possible cross-border impact.

For the DNS, TLD, trust-service, cloud, data-centre, CDN, MSP, MSSP, marketplace, search, and social-platform entities covered by Implementing Regulation (EU) 2024/2690, its recitals treat the entity as aware when its initial assessment provides a reasonable degree of certainty that a significant incident occurred. The regulation also supplies binding horizontal and entity-specific significance criteria. Scheduled interruptions and planned maintenance consequences are excluded under that regulation, while incidents with the same apparent root cause can count collectively when they occur at least twice within six months and together cross its financial-loss criterion. Other entities must use Article 23, national implementing law, and applicable authority guidance.