What counts as a significant incident under NIS2?
One that causes, or could cause, severe disruption, financial loss or considerable damage to others. In the words of Article 23(3), an incident is significant if it has caused or is capable of causing severe operational disruption of your services or financial loss for your company, or if it has affected or can affect other people or organisations by causing considerable material or non-material damage. Only significant incidents must be reported. Capable of means you do not wait for the damage to happen. For certain digital providers, such as cloud, DNS and managed service providers, Implementing Regulation (EU) 2024/2690 sets more precise thresholds; national laws and authorities may publish guidance for others. Decide in advance, in your incident procedure, which criteria you will use, such as services down for a set time, customer data affected or a criminal actor involved, and who makes the call. NetSenX tracks the deadlines once you decide; the decision is yours.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Is a failed or blocked attack reportable under NIS2?
- How can a small team meet the NIS2 24-hour early-warning deadline?
- What should we have ready before the NIS2 24-hour deadline arrives?
- Do we have to tell our own customers about a NIS2 incident?
- Do we have to report a ransomware attack under the GDPR?
← All 35 questions on Incident reporting deadlinesAll topics