NIS2 Art.23.4c: Intermediate Report on CSIRT Request

Prepare an intermediate report template that can be filled in quickly with current incident data. Cover current status (contained, ongoing, escalating), updated severity and impact assessment, new indicators of compromise since the last report, remediation actions and their effectiveness, revised resolution and recovery timeline, any changes to the scope of affected systems or data, cross-border or cascading effects, and resources deployed. Set up a rapid-response process for CSIRT requests. Designate someone to monitor CSIRT communications and mobilise the IR team to compile the required information. Set an internal target of four to eight hours from request to delivery. Keep a continuously updated incident log capturing all significant developments, decisions, and actions throughout the incident. This becomes your primary data source for intermediate reports and means you are not reconstructing events from memory under pressure. Connect your incident tracking to your SIEM, ticketing, and forensic tools. Being able to extract technical data - IoCs, affected systems, containment status - programmatically rather than manually makes a huge difference to report turnaround time. Run exercises that include simulated CSIRT requests for intermediate reports. Test whether the team can produce accurate, comprehensive updates under time pressure and identify process gaps before a real incident forces you to find them. Review every intermediate report for accuracy and appropriate classification before submission. Flag preliminary or unconfirmed information clearly, and separate confirmed facts from assessments based on incomplete data.