NIS2 Art.23.1: Significant Incident Notification Obligation

Write an incident notification policy and procedure that spells out the criteria for classifying an incident as "significant" based on Art.23.3, the internal escalation path from detection to notification decision, your CSIRT or competent authority contact details, notification templates and formats, and who is responsible for preparing and submitting each notification. Build a rapid assessment process that can determine significance within the required timeframes. The early warning must go out within 24 hours of becoming aware of a significant incident, and the full notification within 72 hours. Train your incident response team on the criteria and the process. Prepare notification templates in advance. You need templates for the early warning (nature of the incident, suspected cause, cross-border impact), the full notification (initial assessment, severity, indicators of compromise, mitigation measures), and customer notifications (impact on services, recommended protective actions). Make notification a formal step in your incident response workflow rather than something people remember after the fact. Assign a specific role - incident commander or designated reporter - who owns the notification timeline. Build a relationship with your CSIRT and competent authority before anything goes wrong. Understand their reporting mechanisms, preferred formats, and communication channels. If your sector runs incident reporting exercises, participate. Keep a detailed log of all incident notifications with timestamps for awareness, assessment, and submission. This audit trail proves you met the "without undue delay" requirement. Review and refine your notification procedures regularly based on regulatory guidance, lessons from real notifications, and any changes to reporting requirements.