NIS2 24-hour reporting: early warning, 72-hour notification and final report

Under NIS2, a significant incident starts three deadlines: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report no later than one month after the notification. Here is how each one works and how to count them.

The three deadlines at a glance

Article 23 of the NIS2 Directive sets out a staged reporting process for essential and important entities [1]. Each stage has its own clock and its own content.

Stage	Deadline	Counted from	Main content
Early warning	Without undue delay, at the latest 24 hours	Becoming aware of the significant incident	Whether malicious acts are suspected, whether there could be a cross-border impact
Incident notification	Without undue delay, at the latest 72 hours	Becoming aware of the significant incident	Updates to the early warning, initial assessment of severity and impact, indicators of compromise where available
Intermediate report	Only on request	The request of the CSIRT or competent authority	Relevant status updates
Final report	No later than one month	Submitting the incident notification	Detailed description, severity and impact, root cause or threat type, mitigation measures, cross-border impact

The early warning, notification and final report come from Article 23(1) and 23(4) [1]. The intermediate report is point (c) of Article 23(4): a CSIRT or, where applicable, the competent authority can ask for one [2].

When does the clock start?

Both the 24-hour and the 72-hour deadline run from the moment the entity becomes aware of the significant incident, not from the moment the attack began [1]. That makes the awareness moment the single most important timestamp in your incident log. Write it down as a date, a time and a time zone, together with who became aware and how.

The final report runs on a different clock. It is due no later than one month after you submitted the incident notification [1]. So if you send the notification early, the final report deadline also moves earlier.

The duty only applies to a significant incident. Not every alert or outage qualifies. Read what counts as a significant incident before you decide, and record why you decided either way.

Stage 1: the early warning (24 hours)

The early warning is short on purpose. According to Article 23(4)(a), it should indicate, where applicable, whether the incident is suspected of being caused by unlawful or malicious acts, and whether it could have a cross-border impact [1]. The directive's aim is to make the CSIRT or authority aware of the incident and let you ask for help if you need it.

The CSIRT or competent authority then gives you a response without undue delay and, where possible, within 24 hours of receiving the early warning. That response includes initial feedback and, if you ask for it, guidance on possible mitigation measures [1].

Practical tip: do not wait until you know the root cause. You will not know it at hour 20. Send what you know and say what you do not know yet.

Stage 2: the incident notification (72 hours)

The notification updates the early warning. It adds an initial assessment of the incident, including its severity and impact, and indicators of compromise where they are available [1]. At this stage you usually know which systems are affected, how many users or customers feel it, and what you have done to contain it.

Stage 3: the final report (one month)

The final report must contain [1]:

a detailed description of the incident, including its severity and impact;
the type of threat or root cause that is likely to have triggered the incident;
applied and ongoing mitigation measures;
where applicable, the cross-border impact.

If the incident is still ongoing when the final report is due, you submit a progress report at that moment, and the final report follows within one month after you have handled the incident [1].

Worked example

A regional logistics company in scope of NIS2 runs its planning system in its own data centre. The timestamps below are invented for the example.

Monday 3 March, 09:40 CET: the service desk sees encrypted files on the planning server. At 10:15 the IT lead confirms ransomware and decides it meets the significance criteria, because planning is down for all depots. Awareness time recorded: 10:15.
Early warning due: Tuesday 4 March, 10:15. The team sends it at 14:00 on Monday: suspected malicious act, yes; cross-border impact, possibly, because one depot serves a neighbouring country.
Notification due: Thursday 6 March, 10:15. Sent Wednesday 5 March at 16:30, with the affected systems, the number of depots hit, the encryption hash values found, and the containment steps.
Final report due: no later than one month after the notification, so by 5 April. If recovery is still running then, a progress report goes in on 5 April and the final report follows within a month of closing the incident.

Notice two things. First, sending the notification on Wednesday instead of Thursday pulled the final report deadline forward by a day. Second, the only timestamp that matters for the first two deadlines is 10:15, not 09:40. Keep both in your log, and be ready to explain the gap.

Five steps to stay on time

Agree in advance who can declare that the entity has "become aware", and how that moment is recorded.
Find your national CSIRT or authority's reporting channel now, not during the incident. Member States set the channel, and national law may ask for more detail than the directive.
Prepare drafts for all three reports so you fill in facts instead of writing from scratch. Our incident report template gives you a starting point.
Put the deadlines in a place more than one person can see, with warnings before each one.
Keep a single record of what you sent and when. You will need it for the final report and for any questions from the authority.

Why it matters

NIS2 requires Member States to be able to fine essential entities up to at least EUR 10 000 000 or 2% of total worldwide annual turnover, whichever is higher, and important entities up to at least EUR 7 000 000 or 1.4%, for breaches of obligations that include Article 23 [3]. National law sets the actual amounts.

Deciding how to run this process (spreadsheet, a dedicated tool, or an outside firm) is a separate choice. See the comparison of spreadsheet, tool and consultant.

Related guides

Sources

This guide explains the rules in plain language. It is not legal advice. Check your own country's law and, when in doubt, ask a qualified adviser.