NIS2 incident reporting: spreadsheet, tool or consultant?

You can track NIS2 deadlines and draft reports in a spreadsheet, in a dedicated tool such as NIS2 Incident Clock, or by hiring a consultant, MSSP or law firm. Each fits a different situation. Here is a fair comparison, including when the tool is not the right answer.

What any option must handle

Whatever you choose, it has to cover the same duties from Article 23 of NIS2 [1]: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, a final report no later than one month after the notification, and an intermediate report if the CSIRT or authority asks for one [2]. You also need a record of the decision on whether an incident was significant. See the deadlines explained and the significance test.

Comparison table

	Spreadsheet	NIS2 Incident Clock	Consultant, MSSP or law firm
Cost	No licence cost if you already have the software. Your own time to build and maintain it.	$149 one-time.	Retainer or hourly fees. Ask for quotes; prices vary widely by firm and scope.
Set-up time	Hours to build formulas and templates, plus testing.	Open the file; deadlines are pre-built.	Contract, onboarding and contact procedures before an incident.
Deadline warnings	Only if you build them. Easy to break by editing a cell.	Overdue and due-soon warnings for each report.	Depends on the firm's own process.
Report drafts	You write them.	Drafts for early warning, notification and final report with the Article 23 content.	They write or review them for you.
Data privacy	Stays local, unless the file sits in a shared cloud drive.	Runs in your browser; no server, account or upload.	Incident details are shared with a third party under contract.
Expert judgement	None.	None. It structures the questions; you decide.	Yes: legal and forensic advice.
Main risk	Formula errors, no one owns the file, wrong version used.	It does not submit reports, analyse your network or give legal advice.	Availability at 3 a.m., cost, dependence on an outside party.

Option 1: a spreadsheet

A spreadsheet is the cheapest start and is fully under your control. Adding 24 hours, 72 hours and one month to a timestamp is not hard. The risks are elsewhere: the "one month" is counted from the notification, not from awareness [1], which is easy to get wrong in a formula; templates drift between versions; and during an incident nobody wants to debug a cell. If you go this way, lock the formula cells, test the sheet with a dummy incident, and store one master copy.

Right choice when: you have very few incidents, someone on the team is comfortable maintaining it, and you will test it regularly.

Option 2: NIS2 Incident Clock

The tool is one offline HTML file. You start the clock when you become aware, it sets every deadline, warns before each one, walks through the two criteria of Article 23(3), and gives you drafts with the content Article 23 asks for. It keeps a record you can export.

Be clear about what it does not do. It does not submit anything to your CSIRT; you use your national form. It does not know national additions to the directive, so you check those yourself. It does not analyse logs or tell you who attacked you. And it is not legal advice.

Right choice when: you have an internal IT or security lead who will handle incidents, you want the deadlines and drafts ready without building them, and you do not want incident details on someone else's server while the incident is open.

Option 3: a consultant, MSSP or law firm

An outside firm brings what neither a spreadsheet nor a tool can: judgement. A law firm can advise whether an incident is significant under your national law and how reporting interacts with other duties. An incident response firm or MSSP can investigate, contain and give you the facts the reports need, such as indicators of compromise and root cause [1].

Right choice when:

you have no in-house security staff who can run an incident;
the incident is serious, contested, or may lead to claims, and you need legal advice;
you need forensic work to find the root cause for the final report;
you operate in several Member States and need to know each national variant.

In those cases a consultant is the better choice, and a tool alone is not enough. Check before signing whether they are reachable around the clock, because the 24-hour deadline does not pause at weekends.

Combining them

These options are not exclusive. Many organisations keep the deadlines and drafts in-house and call in a firm for forensics or legal review when an incident is serious. The in-house record then gives the firm a clean timeline to start from. Managed service providers who handle incidents for clients can use one tool per client to keep deadlines apart.

Questions to decide

Who in your organisation will declare that you have become aware, at any hour?
Can that person write an early warning without outside help?
Are you allowed, under your contracts and policies, to share incident details with a third party during the incident?
How often do you expect a possibly significant incident?
Do you need someone to stand behind the decision legally?

The penalties make the choice worth some thought: Member States must be able to fine essential entities up to at least EUR 10 000 000 or 2% of worldwide annual turnover, and important entities up to at least EUR 7 000 000 or 1.4%, whichever is higher in each case [3]. To see what the reports look like, open the incident report template.

Related guides

Sources

This guide explains the rules in plain language. It is not legal advice. Check your own country's law and, when in doubt, ask a qualified adviser.