NIS2 Article 23

NIS2 incident reporting: deadline calculator and early warning template

NIS2 incident reporting is the duty of an essential or important entity to notify its CSIRT or competent authority of every significant incident in stages: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, an intermediate report if the authority asks for one, and a final report no later than one month after the incident notification. The clock starts when you become aware of the incident, not when it began. The calculator below turns that moment into dates, and the template lists what the early warning has to say.

The fact to plan around

Under Article 23(3) of NIS2 (Directive (EU) 2022/2555), an incident is significant if it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned, or if it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.

Source: Directive (EU) 2022/2555 (NIS2), Articles 21, 23 and 41 — EUR-Lex

Deadline calculator

Enter the date and time you became aware of the significant incident. The dates are computed in your browser, in its time zone; nothing you enter is sent anywhere.

Enter a date and time to see the deadlines.

  • Intermediate report: whenever the CSIRT or the competent authority asks for one.
  • If the incident is still ongoing when the final report is due, a progress report is due then instead, and the final report within one month of handling the incident.
  • Check your national law: the law that transposes NIS2 in your country can name the channel and the form, and add further requirements to these deadlines.

Early warning template

The two points Article 23(4)(a) asks for, plus the details your CSIRT will need to reach you. Copy it into your own reporting channel; national forms may ask for more.

NIS2 early warning (Directive (EU) 2022/2555, Article 23(4)(a))
Entity name and sector:
Contact person, telephone and e-mail:
Date and time the entity became aware of the incident:
What is known so far, in two or three sentences:
Suspected to be caused by unlawful or malicious acts? (yes / no / not yet known):
Could it have a cross-border impact? (yes / no / not yet known):
Services affected so far:
Guidance or operational advice requested from the CSIRT, if any:

What each deadline asks of you

Open a milestone to see what the report has to contain, what NetSenX already has ready for it and what stays with you. No deadline pauses for a weekend or a public holiday.

  • 24 hours: early warning (NIS2 Article 23(4)(a))
    What the report needs
    Whether the significant incident is suspected of being caused by unlawful or malicious acts, and whether it could have a cross-border impact. Short by design.
    What NetSenX has ready
    The incident and its deadlines tracked from the moment you record it, and the alerts that started it, each explained in plain language, on every plan.
    What stays with you
    Deciding that the incident is significant, and sending the early warning to your CSIRT or competent authority.
  • 72 hours: incident notification (NIS2 Article 23(4)(b))
    What the report needs
    An update of the early warning and an initial assessment: severity, impact and, where available, indicators of compromise.
    What NetSenX has ready
    The alert timeline with the hosts, destinations and times involved, and the audit log of what was seen and decided. PDF reports from the Starter plan.
    What stays with you
    The assessment of severity and impact, the indicators you choose to share, and the submission.
  • One month: final report (NIS2 Article 23(4)(d))
    What the report needs
    A detailed description with severity and impact, the type of threat or root cause, the mitigation applied and ongoing, and any cross-border impact.
    What NetSenX has ready
    The full record kept for your plan's alert history, and the MITRE ATT&CK technique named on alerts that correspond to one.
    What stays with you
    The root-cause analysis, the mitigation itself and the report. If the incident is still ongoing, a progress report is due instead.
  • 72 hours: personal data breach (GDPR Article 33)
    What the report needs
    The nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken, sent to the supervisory authority.
    What NetSenX has ready
    A GDPR Article 33 breach notification prepared for your data protection officer from the incident record.
    What stays with you
    Whether personal data is affected and whether the breach must be notified, the notification itself and any message to the people concerned.

Check your national law: the law that transposes NIS2 in your country can name the channel and the form, and add further requirements to these deadlines.

What each report has to contain

Article 23(4) of the directive, stage by stage. National laws transposing NIS2 can add fields or prescribe a form.

  1. 01Early warning: within 24 hours

    Whether the significant incident is suspected of being caused by unlawful or malicious acts, and whether it could have a cross-border impact. It is short by design: the details come later.

  2. 02Incident notification: within 72 hours

    An update of the early warning and an initial assessment of the incident, including its severity and impact and, where available, the indicators of compromise.

  3. 03Intermediate report: on request

    Relevant status updates, when the CSIRT or the competent authority asks for them.

  4. 04Final report: one month after the notification

    A detailed description of the incident, including its severity and impact; the type of threat or root cause that is likely to have triggered it; the mitigation measures applied and ongoing; and, where applicable, its cross-border impact.

What NetSenX does today

  • Tracks each incident against the NIS2 Article 23 deadlines (24 hours, 72 hours, one month) and prepares a GDPR Article 33 breach notification for your DPO. PDF reports from the Starter plan.
  • Detects command-and-control beaconing, scanning and lateral movement, and unusual outbound data volume from network behaviour, so the incident is found early enough for the clock to matter.
  • Explains every alert in plain language, on every plan, and writes alerts, analyst decisions and configuration changes to an audit log you can hand to your auditor.
  • Names the MITRE ATT&CK technique on the alert where a detection corresponds to one, which helps describe the type of threat in the final report.

What NetSenX does not do

NetSenX does not decide whether an incident is significant or whether your organisation is in scope of NIS2, and it does not submit reports to your CSIRT or competent authority on your behalf. The calculator applies the directive's own deadlines; national laws transposing NIS2 can add detail, such as the channel or form to use, so check your country's rules.

Questions buyers ask

When does the NIS2 24-hour clock start?

When the entity becomes aware of the significant incident, not when the incident began. Article 23(4) counts both the early warning (24 hours) and the incident notification (72 hours) from that moment.

What has to be in a NIS2 early warning?

Under Article 23(4)(a), the early warning indicates, where applicable, whether the significant incident is suspected of being caused by unlawful or malicious acts and whether it could have a cross-border impact. The details follow in the 72-hour notification.

Is the final report due one month after the incident?

No: one month after the submission of the incident notification. If the incident is still ongoing at that point, a progress report is due instead, and the final report within one month of the incident being handled.

Are the deadlines different for trust service providers?

Yes. A trust service provider notifies significant incidents that affect the provision of its trust services within 24 hours of becoming aware of them, instead of 72 hours.

Sources

  1. Directive (EU) 2022/2555 (NIS2), Articles 21, 23 and 41 — EUR-Lex
  2. European Commission — NIS2 transposition status by Member State

This page is general information, not legal advice. Check your obligations with your national authority or legal counsel.

Related pages

Try NetSenX on your own network

Start on the Free plan with up to 3 devices, or book a 20-minute demo.

See pricingBook a demo