Is a failed or blocked attack reportable under NIS2?
Usually not as a significant incident, but it can be, and you can report it voluntarily. The mandatory duty in Article 23 covers significant incidents: those that caused, or could have caused, severe disruption, financial loss or considerable damage to others. An attack that was stopped before it had any effect normally does not meet that test, although one that came very close, for example ransomware caught after it had reached the backup server, may. NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. also distinguishes near misses and significant cyber threats, and Article 30 lets entities notify them voluntarily, which helps the CSIRTCSIRT: computer security incident response team. The national team to which serious incidents are reported. warn others. Record every such event in your incident register with your reasoning, so you can explain later why you did or did not report. NetSenX keeps the alerts behind each decision.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- How can a small team meet the NIS2 24-hour early-warning deadline?
- What should we have ready before the NIS2 24-hour deadline arrives?
- Do we have to tell our own customers about a NIS2 incident?
- Do we have to report a ransomware attack under the GDPR?
- If the stolen data was encrypted, must we still notify?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.
- CSIRT (computer security incident response team)
- The national team to which serious incidents are reported.
← All 35 questions on Incident reporting deadlinesAll topics