NIS2 incident clock triage workflow

Open the clock file when an event could have a significant impact on the provision of an in-scope service. The first decision is not whether the final report can be drafted; it is whether the entity has enough information to treat the event as a potential NIS2 significant incident and preserve the awareness timeline.

Separate four timestamps: first technical signal, human triage, entity awareness of a possible significant incident, and any authority submission. That separation matters because Article 23 deadlines run from becoming aware of the significant incident, while Commission Implementing Regulation (EU) 2024/2690 explains that awareness follows an initial assessment giving the entity a reasonable degree of certainty that a significant incident has occurred.

Use the significance triage to decide whether Article 23 is in play. Under NIS2, a significant incident is tied to severe operational disruption, financial loss for the entity, or considerable material or non-material damage affecting other natural or legal persons.

The triage should produce a defensible yes, no, or continue-monitoring decision. It should not wait for perfect forensic certainty, and it should not turn every security alert into a reportable incident without linking the facts to the Article 23 impact test.

When the triage points to a significant incident, move immediately to the staged Article 23 clock. The early warning is due without undue delay and in any event within 24 hours of awareness. The incident notification is due without undue delay and in any event within 72 hours of awareness.

Use the 24-hour step to alert the CSIRT or competent authority with the information needed at that point, including whether malicious or unlawful acts are suspected and whether there may be cross-border impact. Use the 72-hour step to update the early warning with an initial severity and impact assessment and available indicators of compromise.

The triage record should identify who owns each external communication path. Article 23 notification goes to the CSIRT or, where applicable, the competent authority. Recipient communications are a separate decision when significant incidents are likely to adversely affect the provision of services or when recipients can take measures or remedies in response to a significant cyber threat.

Do not leave cross-border, law-enforcement, trust-service-provider, or public-disclosure questions until after the deadline. Article 23 includes routes for single points of contact, other affected Member States and ENISA, law-enforcement guidance where criminal activity is suspected, and public awareness where necessary or in the public interest.

A usable clock file shows what the team knew, when it knew it, why the incident was or was not treated as significant, and what was submitted or communicated at each reporting point. The file should support live response first and later review second.

For entities covered by Commission Implementing Regulation (EU) 2024/2690, align the triage evidence with the required incident-handling policy: incident categorisation, escalation, communication plans, assigned roles, response documents, documentation, reporting, and post-incident improvement.

Close the clock triage only after the team can explain the decision from the record alone. If the event remains uncertain, keep the file open with a named owner, next fact needed, and next review time.

The closure decision should also consider whether the incident triggers post-incident review, risk-assessment updates, business-continuity changes, supplier follow-up, or management-body reporting. The implementing regulation repeatedly ties significant incidents to review and update duties for incident handling, risk treatment, continuity, crisis management, and related controls.