NIS2 Art.23.3: Incident Significance Assessment Criteria

Write a documented significance assessment procedure that maps Art.23.3 criteria to your specific organisation. The procedure needs to be fast - ideally producing a determination within one to two hours of detection, leaving enough runway for the 24-hour early warning deadline. Define concrete thresholds, both quantitative and qualitative. Think about service disruption affecting a certain percentage of users or lasting beyond a set duration, financial loss above a given amount, personal data compromise beyond a certain number of individuals, downstream impact on other entities, involvement of advanced persistent threats or state-sponsored actors, and anything touching critical infrastructure. Build a simple decision matrix or flowchart that incident responders can follow under pressure. It needs to produce consistent results no matter who is on shift. Add a review step where a senior incident responder or designated authority validates the initial assessment. This is a quality check, not a bottleneck - keep it fast. Document every significance assessment, including the ones where you decide an incident is not significant. If a regulator asks why something was not reported, you want a clear paper trail showing the reasoning. Review your thresholds regularly. Update them when your services change, when regulators issue new guidance or implementing acts, after post-incident reviews reveal your thresholds were miscalibrated, or when industry benchmarks shift. Train every member of the incident response team on the assessment process. Run significance assessment scenarios during your tabletop exercises so the process feels natural when it matters.