NIS2 incident clock triage workflow

Open the clock file when an event could have a significant impact on an in-scope service. Decide whether the entity has enough information to treat the event as a potential NIS2 significant incident and preserve the awareness timeline; a final report can be developed later.

Separate four timestamps: first technical signal, human triage, entity awareness of the significant incident, and each authority submission. Article 23 deadlines run from awareness of the significant incident. For provider types covered by Commission Implementing Regulation (EU) 2024/2690, recital 31 says awareness follows an initial assessment that gives the entity a reasonable degree of certainty that a significant incident has occurred. Other entities should check national law and authority guidance rather than assuming that recital controls their case.

Confirm scope before treating the clock as a legal deadline. Article 23 applies to essential and important entities through the Member State law implementing NIS2. A voluntary vulnerability disclosure, near-miss report, or sector-specific report may use a different trigger and route; do not merge it into the Article 23 clock unless the applicable law requires that result.

Use the significance triage to decide whether Article 23 is in play. Under NIS2, a significant incident is tied to severe operational disruption, financial loss for the entity, or considerable material or non-material damage affecting other natural or legal persons.

The triage should produce a defensible yes, no, or continue-monitoring decision. It should not wait for perfect forensic certainty, and it should not turn every security alert into a reportable incident without linking the facts to the Article 23 impact test.

When the triage points to a significant incident, move immediately to the staged Article 23 clock. The early warning is due without undue delay and in any event within 24 hours of awareness. The incident notification is due without undue delay and in any event within 72 hours of awareness.

Use the 24-hour step to alert the CSIRT or competent authority with the information needed at that point, including whether malicious or unlawful acts are suspected and whether there may be cross-border impact. Use the 72-hour step to update the early warning with an initial severity and impact assessment and available indicators of compromise.

The triage record should identify who owns each external communication path. Article 23 notification goes to the CSIRT or, where applicable, the competent authority. Recipient communications are a separate decision when significant incidents are likely to adversely affect the provision of services or when recipients can take measures or remedies in response to a significant cyber threat.

Do not leave cross-border, law-enforcement, trust-service-provider, or public-disclosure questions until after the deadline. Article 23 includes routes for single points of contact, other affected Member States and ENISA, law-enforcement guidance where criminal activity is suspected, and public awareness where necessary or in the public interest.

A usable clock file shows what the team knew, when it knew it, why the incident was or was not treated as significant, and what was submitted or communicated at each reporting point. The record should support live response first and later review second.

For entities covered by Commission Implementing Regulation (EU) 2024/2690, align the triage evidence with the required incident-handling policy: incident categorisation, escalation, communication plans, assigned roles, response documents, documentation, reporting, and post-incident improvement.

Close the clock triage only after the team can explain the decision from the record alone. If the event remains uncertain, keep the file open with a named owner, next fact needed, and next review time.

The closure decision should also consider whether the incident triggers post-incident review, risk-assessment updates, business-continuity changes, supplier follow-up, or management-body reporting. The implementing regulation repeatedly ties significant incidents to review and update duties for incident handling, risk treatment, continuity, crisis management, and related controls.