What information should an incident report to the authorities contain?

The basics are the same everywhere: what happened, when, what was affected, how bad it is, what you have done and whom to contact. Under NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. Article 23(4), the early warning says whether the incident is suspected to be malicious or unlawful and whether it could have a cross-border impact; the 72-hour notification adds an initial assessment of severity and impact and, where available, indicators of compromise; and the final report adds a detailed description, the type of threat or root cause, mitigation measures and cross-border impact. Under GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). Article 33(3), a breach notification describes the nature of the breach, the categories and approximate numbers of people and records, the likely consequences, the measures taken and the data protection officer's contact. Keep facts and assumptions clearly separate. NetSenX supplies times, devices, destinations and volumes from the network.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 35 questions on Incident reporting deadlinesAll topics