We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

FAQEU

NIS2 72-hour incident notification

Article 23 generally requires the incident notification without undue delay and within 72 hours of awareness. A trust service provider has 24 hours when the significant incident affects its trust services.

Use it to update the 24-hour early warning with the initial severity and impact assessment, available indicators of compromise, authority route, and evidence trail.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 25, 2026
Questions
3

Structured answer sets in this page tree.

Primary sources
5

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 25, 2026
Overview

NIS2 Article 23 requires essential and important entities to notify their or, where applicable, competent authority of significant incidents. The is due without undue delay and within 72 hours of awareness, follows the 24-hour early warning, and must include an initial severity and impact assessment plus available indicators of compromise. For a trust service provider, the incident notification is due within 24 hours when the affects its trust services.

Search this module

Find a question or answer quickly

3 of 3 questions
Question 1

What does the NIS2 72-hour incident notification require?

Submit the without undue delay and in any event within 72 hours of becoming aware of a . It must update the early warning where applicable and indicate the entity's initial assessment, including severity and impact and, where available, indicators of compromise.

Do not wait for perfect root-cause certainty if the Article 23 significance threshold is met. Record what is known, what is estimated, what is unavailable, and which facts will be updated through intermediate reports or the final report.

  • Confirm that the incident is significant because it has caused, or is capable of causing, severe operational disruption, financial loss, or considerable material or non-material damage to others.
  • For DNS, TLD, cloud, data-centre, CDN, MSP, MSSP, marketplace, search, social-platform, and trust-service entities covered by Implementing Regulation (EU) 2024/2690, apply its horizontal and provider-specific significance criteria as well as Article 23 and national law.
  • Start the 72-hour clock from awareness of the , not from the early-warning submission. Preserve detection, initial assessment, awareness, early-warning, and incident-notification times separately.
  • Send the notification to the or, where applicable, competent authority for the relevant Member State route.
  • Update the early warning and state the initial severity and impact assessment and available indicators of compromise. Label estimates and facts still under investigation.
  • Apply the 24-hour incident-notification deadline instead if the reporting entity is a trust service provider and the affects its trust services.
  • Keep the submission receipt, report version, approver, and known uncertainty in the incident file.

How should teams handle the NIS2 72-hour ?

Treat it as the Article 23 for a . Without undue delay and within 72 hours of awareness, submit an update to the or competent authority that gives an initial severity and impact assessment and available indicators of compromise. Record the awareness time, route, facts known at submission, uncertainty, and follow-up. A trust service provider must use a 24-hour incident-notification deadline for a significant incident affecting its trust services.

Citations
Directive (EU) 2022/2555 (NIS2), Article 23

Primary legal source for the 72-hour incident notification, the trust-service-provider 24-hour derogation, the significant-incident threshold, required content, and staged reporting sequence described in recital 102.

Question 2

What should the 72-hour notification record contain?

The record should let incident responders, management, and an authority reconstruct the decision. It should show why the incident met the significance threshold, when the entity became aware, what was submitted, what evidence supported the initial assessment, and what remained unknown.

Separate the authority notification from customer, recipient, public, and law-enforcement communications. Article 23 includes recipient communication and authority guidance paths, but those decisions may have different owners, approval steps, and confidentiality constraints.

  • Entity and service: the essential or important entity, affected service, affected systems, and Member State reporting route.
  • Clock evidence: detection, escalation, initial assessment, awareness, early-warning submission, incident-notification submission, authority acknowledgement, and the documented reason for any delayed step.
  • Impact assessment: operational disruption, financial-loss indicators, affected recipients or third parties, and material or non-material damage indicators.
  • Technical facts: incident timeline, available indicators of compromise, suspected unlawful or malicious activity, and known cross-border impact.
  • Follow-up plan: requested intermediate reports, mitigation work, recipient communications, final-report owner, and final-report deadline.
Citations
Question 3

What happens after the 72-hour notification?

After the , provide intermediate reports when the or competent authority requests status updates. The final report is due no later than one month after the incident notification and must include a detailed description, severity and impact, the likely threat type or root cause, applied and ongoing mitigation measures, and cross-border impact where applicable.

If the incident is still ongoing when the final report would otherwise be due, Article 23 calls for a progress report at that time and a final report within one month after handling the incident.

  • Track authority requests for intermediate reports and assign a status-update owner.
  • Keep root-cause language qualified until the investigation supports it.
  • Update mitigation evidence as containment, eradication, recovery, and longer-term remediation work progresses.
  • Escalate suspected criminal conduct through the guidance path offered by the or competent authority.
  • Document cross-border and recipient-impact decisions separately from the authority submission.
Citations
Recommended next step

This FAQ is a cited incident-reporting checklist

Sorena can turn the NIS2 72-hour notification requirements into owner assignments, incident-clock evidence, report templates, and cited-source review steps.

Research workflow
Open Research Copilot for NIS2

Ask questions tied to cited sources about Article 23 incident reporting, significant-incident thresholds, evidence fields, and follow-up reports.

Explore next step
Talk to Sorena
Talk through implementation

Review your NIS2 notification clock, authority route, report content, and evidence file with Sorena.

Explore next step
Primary sources

References and citations

Commission Implementing Regulation (EU) 2024/2690
eur-lex.europa.eu
Referenced sections
  • Binding source for horizontal and provider-specific significant-incident criteria and the awareness explanation for the covered digital and trust-service entities.
"reasonable degree of certainty"
Directive (EU) 2022/2555 (NIS2)
eur-lex.europa.eu
Referenced sections
  • Primary legal source for Article 23 significant-incident reporting obligations, including the 24-hour early warning, 72-hour incident notification, intermediate reports, final reports, and authority routing.
"Reporting obligations"
Directive (EU) 2022/2555 (NIS2), Article 23
eur-lex.europa.eu
Referenced sections
  • Sets the intermediate-report, final-report, ongoing-incident progress-report, law-enforcement guidance, and cross-border sharing rules.
"final report"
ENISA - NIS2 technical implementation guidance
enisa.europa.eu
Referenced sections
  • Provides practical implementation guidance and examples of evidence for NIS2 cybersecurity risk-management requirements for entities covered by the implementing regulation.
"examples of evidence"
European Commission - NIS2 Directive overview
digital-strategy.ec.europa.eu
Referenced sections
  • Commission overview for NIS2 scope, reporting requirements, national authorities, and incident-response cooperation.
"significant incidents"
Related guides

Explore more topics

Are managed service providers in scope of NIS2?
NIS2 scope answer for managed service providers and managed security service providers, including service definition, size-cap checks, entity status, and jurisdiction evidence.
EU NIS2 Directive applicability test for entity scope
Stepwise NIS2 applicability test for Annex I and Annex II sectors, medium and large entities, size-independent cases, essential or important classification, jurisdiction, and evidence.
EU NIS2 Directive deadlines and compliance calendar | Article 23 clocks
NIS2 compliance calendar for EU transposition, Article 3 and 27 registration updates, Article 23 incident reports, technical measures, and the 2027 review.
NIS2 24-hour early warning: what to send and when
Under NIS2 Article 23, covered essential and important entities submit an early warning within 24 hours of becoming aware of a significant incident.
NIS2 Annex I and Annex II Sector Scoping Guide
Map NIS2 Annex I and Annex II sectors, entity types, size-cap rules, and essential versus important entity classification with official EU sources.
NIS2 Article 21 control baseline and evidence checklist
Build a NIS2 Article 21 control baseline from the Directive's minimum cybersecurity risk-management measures, proportionality test, supplier duties, and evidence expectations.
NIS2 Article 21 control-by-control evidence checklist
Map NIS2 Article 21 risk-management measures to evidence records for governance, incident handling, continuity, supply chain, testing, cyber hygiene, cryptography, access, assets, and authentication.
NIS2 Article 21 Gap Assessment Workflow: controls, evidence, and owners
Assess NIS2 Article 21 cybersecurity risk-management gaps by mapping current controls to Article 21(2), ownership, evidence, supplier risk, and management review.
NIS2 Article 23 incident notification workflow
Map NIS2 Article 23 reporting duties for significant incidents: 24-hour early warning, 72-hour notification, intermediate reports, final report, recipients, and evidence.
NIS2 Compliance Checklist: scope, controls, reporting
This NIS2 compliance checklist helps confirm scope, entity classification, management-body duties, Article 21 controls, Article 23 reporting, and evidence.
NIS2 Compliance Guide: scope, controls, reporting, and evidence
A practical NIS2 compliance guide for mapping entity scope, Article 21 risk measures, Article 23 incident reporting, management accountability, and evidence records.
NIS2 Country Implementation Matrix: Authorities, Portals, and Local Deltas
Build an operational NIS2 country matrix for applicable national law, competent authorities, registration, incident portals, local implementation deltas, evidence, and review dates.
NIS2 entity classification FAQ
Plain-English FAQ comparing NIS2 essential entities and important entities, with Article 3 classification rules, shared Article 21 and 23 duties, supervision differences, and evidence to keep.
NIS2 Entity Classifier Workflow: essential vs important entity scoping
Classify whether an EU service is out of scope, an important entity, an essential entity, or needs national-authority review under the NIS2 Directive.
NIS2 entity supervision guide
Compare NIS2 essential and important entities by scope, Article 21 and 23 duties, Article 32 and 33 supervision, evidence, jurisdiction, and penalties.
NIS2 essential vs important entities: Article 3 scope and supervision guide
Classify NIS2 essential and important entities using Article 3, Annex I and II sector scope, size-cap rules, registration evidence, and the Article 32/33 supervision split.
NIS2 FAQ: scope, Article 21 controls, incident reporting, and penalties
NIS2 FAQ on entity scope, essential and important classification, Article 21 measures, Article 23 reporting, national implementation, and evidence.
NIS2 incident clock triage workflow
Triage a possible NIS2 significant incident by recording awareness time, severity, impact, authority route, recipient communications, and Article 23 reporting clocks.
NIS2 Incident Reporting Workflow: 24-hour, 72-hour, and final report steps
Build a NIS2 Article 23 incident reporting workflow with significance triage, CSIRT or authority notification steps, recipient communication, cross-border checks, and evidence records.
NIS2 Management Body Accountability: board duties, training, and evidence
A guide to NIS2 Article 20 management body accountability: approval of Article 21 measures, oversight, national liability rules, training, reporting lines, and evidence.
NIS2 Member State Transposition: What Teams Must Check
How to handle NIS2 Member State transposition: use Article 41 as the EU baseline, then verify national law, authority routing, registration, and incident-reporting details.
NIS2 National Transposition Tracker: EU Member State Evidence Register
Track NIS2 national transposition with Commission country pages, Article 41 dates, reasoned-opinion flags, source wording, authority contacts, and legal review triggers.
NIS2 penalties and fines: Article 34 maximum levels and factors
NIS2 Article 34 fine levels, calculation factors, enforcement measures, GDPR overlap, and national-law checks for essential and important entities.
NIS2 Registration and Authority Notification Guide
Map NIS2 Article 3 entity-list duties, Article 27 registry submissions, competent-authority contacts, and national registration portal evidence without inventing country deadlines.
NIS2 Requirements: scope, Article 21 controls, reporting, and evidence
Map NIS2 requirements for essential and important entities: scope classification, management-body duties, Article 21 cybersecurity measures, Article 23 incident reporting, and evidence records.
NIS2 Size Cap Rule and Special Scope Cases
Apply the NIS2 medium-size test, group-data rules, regardless-of-size cases, exclusions, and essential-versus-important classification.
NIS2 size-cap rule: when medium and large entities are in scope
Plain-language FAQ on the NIS2 size-cap rule: medium and large Annex I or II entities, SME thresholds, regardless-of-size exceptions, and evidence to keep.
NIS2 Supply Chain Security Program: Article 21 Guide
Apply NIS2 Article 21 to direct suppliers and service providers, and distinguish its general duty from Regulation 2024/2690's digital-entity controls.
NIS2 vs CER Directive comparison: cyber obligations and critical-entity resilience
Compare NIS2 and the CER Directive using cited rows for scope, triggers, evidence, incident handling, supervision, and shared critical-entity work.
NIS2 vs DORA: scope, overlap, and evidence for EU cyber compliance
Compare NIS2 and DORA for EU cyber compliance: covered entities, when DORA replaces NIS2 duties for financial entities, incident reporting, evidence, and supervisory handoffs.
NIS2 vs GDPR breach reporting: EU deadlines and overlap
Compare NIS2 significant-incident reporting with GDPR personal-data-breach reporting, including scope, 24-hour and 72-hour clocks, evidence, and overlap.
NIS2 vs ISO/IEC 27001: legal duties, ISMS evidence, and reuse limits
Compare NIS2 legal obligations with ISO/IEC 27001 ISMS requirements: scope, Article 21 controls, incident clocks, SoA evidence, audits, and certification reuse.
NIS2 vs ISO/IEC 27017: legal duties, cloud controls, and reuse limits
Compare NIS2 legal obligations with ISO/IEC 27017 cloud-service controls: entity scope, Article 21 measures, incident clocks, shared responsibility, evidence, and assurance limits.
NIS2 vs NIS1: what changed in EU cybersecurity compliance
Compare NIS2 with the repealed NIS1 Directive: expanded sectors, essential and important entities, management-body duties, Article 21 controls, Article 23 reporting, and supervision.