How can a small team meet the NIS2 24-hour early-warning deadline?
By preparing the parts that do not depend on the incident before anything happens. The early warning under Article 23(4)(a) is short: it says that a significant incident has occurred and, where applicable, whether it is suspected to be unlawful or malicious and whether it could have a cross-border impact. The details follow in the 72-hour notification. So prepare a one-page template, the reporting channel and login for your national CSIRTCSIRT: computer security incident response team. The national team to which serious incidents are reported. or authority, a named person and a deputy who may submit it, and an internal rule for who decides that an incident is significant. Hold one rehearsal a year. Small teams lose most time finding out what happened, so make sure alerts reach someone at night and at weekends. NetSenX starts the deadline clock per incident and keeps the alerts with time, devices and destinations in one place.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- What should we have ready before the NIS2 24-hour deadline arrives?
- Do we have to tell our own customers about a NIS2 incident?
- Do we have to report a ransomware attack under the GDPR?
- If the stolen data was encrypted, must we still notify?
- We cannot complete the GDPR notification within 72 hours. Can we notify in phases or late?
Terms used here
- CSIRT (computer security incident response team)
- The national team to which serious incidents are reported.
← All 35 questions on Incident reporting deadlinesAll topics