How do cyber incidents affect our customer contracts?

Through notification duties, service levels and liability clauses you may already have signed. Many contracts require you to tell the customer about a security incident within a set time, to meet availability levels and to protect their data to a stated standard; customers that fall under NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. or DORA often write such duties into supplier contracts. A missed notice can be a breach of contract on its own, separate from the incident. Before anything happens, list your largest contracts and their incident clauses, and add that list to the incident plan so the right people are told on time. Check whether your insurance covers contractual liability. NetSenX evidence helps answer the questions customers ask afterwards: when it started, which devices were involved and what left the network.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 40 questions on For the board and financeAll topics