# What information should an incident report to the authorities contain?

The basics are the same everywhere: what happened, when, what was affected, how bad it is, what you have done and whom to contact. Under NIS2 Article 23(4), the early warning says whether the incident is suspected to be malicious or unlawful and whether it could have a cross-border impact; the 72-hour notification adds an initial assessment of severity and impact and, where available, indicators of compromise; and the final report adds a detailed description, the type of threat or root cause, mitigation measures and cross-border impact. Under GDPR Article 33(3), a breach notification describes the nature of the breach, the categories and approximate numbers of people and records, the likely consequences, the measures taken and the data protection officer's contact. Keep facts and assumptions clearly separate. NetSenX supplies times, devices, destinations and volumes from the network.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Incident reporting deadlines](https://netsenx.com/en/faq/reporting) · https://netsenx.com/en/faq/what-should-an-incident-report-contain

## Read next

- https://netsenx.com/en/nis2-incident-reporting-deadlines
- https://netsenx.com/en/nis2-network-monitoring

## Related questions

- [Do we still have to report an incident that is already resolved?](https://netsenx.com/en/faq/can-we-report-an-incident-that-is-already-resolved)
- [What reduces a GDPR fine after a data breach?](https://netsenx.com/en/faq/what-reduces-a-gdpr-fine-after-a-data-breach)
- [Can NetSenX prepare a GDPR Article 33 breach notification?](https://netsenx.com/en/faq/can-netsenx-prepare-a-gdpr-article-33-notification)
- [Does a security tool's audit log help with IT general controls?](https://netsenx.com/en/faq/does-a-security-tools-audit-log-help-with-it-general-controls)
- [How do we prove who changed a security setting, and when?](https://netsenx.com/en/faq/how-do-we-prove-who-changed-a-security-setting)