What does the BSI do after we submit an incident report?
It confirms receipt and can help, and in some cases it can require you or itself to inform the public. Under section 36(1) of the BSIG, the BSI sends the reporting entity a confirmation of receipt without undue delay and, where possible, within 24 hours, and on request provides guidance or operational advice on remedial measures; it can also offer additional technical support on request. Under section 36(2), if public awareness is needed to prevent or handle a significant incident, or disclosure is otherwise in the public interest, the BSI can, after hearing the entity, oblige it to inform the public, or inform the public itself. The BSI also uses reports to warn others and to build the national picture. Reporting does not create new obligations that would not apply otherwise: section 30(7) says so for voluntary reports and information exchange. Keep your own copy of everything you submitted.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.