What should we have ready before the NIS2 24-hour deadline arrives?
A short list of facts, a ready channel and a person who may send it. For the early warning itself you need: the time you became aware of the incident; a plain description of what is affected so far; whether you suspect a malicious or unlawful act; and whether other countries could be affected. For the 72-hour notification that follows, start collecting at once: severity and impact, affected systems and services, indicators of compromise such as malicious addresses or file hashes, and the measures taken. Keep a running timeline from the first minute, with who did what. Check whether personal data is involved, because a GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). notification may run in parallel. NetSenX gives you the network part of that timeline: the first unusual connection, the devices involved, destinations and volumes, and the Article 23 deadlines counted from the moment you record awareness.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Do we have to tell our own customers about a NIS2 incident?
- Do we have to report a ransomware attack under the GDPR?
- If the stolen data was encrypted, must we still notify?
- We cannot complete the GDPR notification within 72 hours. Can we notify in phases or late?
- When does the GDPR 72-hour notification clock start?
Terms used here
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).
← All 35 questions on Incident reporting deadlinesAll topics