NIS2 Art.23.8: Cross-Border Incident Notification

Start by mapping the cross-border footprint of your operations. Identify which services reach customers in other Member States, where your data processing spans jurisdictions, which infrastructure dependencies (cloud providers, CDNs, data centres) sit abroad, and where your supply chain crosses borders. Build cross-border impact assessment into your incident evaluation process. For every significant incident, specifically consider whether affected services have users in other Member States, whether the incident could propagate through interconnected systems to other jurisdictions, and whether the attack pattern suggests a coordinated campaign across multiple countries. Make sure your early warning and notification templates include clear fields for cross-border impact: which Member States are potentially affected, what the nature of the impact is, and which services or sectors are involved in each jurisdiction. If you operate under NIS2 obligations in multiple Member States, understand your reporting requirements in each one. The cooperation mechanisms should prevent you from having to report the same incident multiple times, but you need to know your primary reporting obligations. Establish contacts with CSIRTs in every Member State where you have significant operations. Knowing the regulatory landscape in advance saves valuable time during a real incident. Coordinate your customer communications across jurisdictions. Consider local language requirements, differing regulatory expectations, and time zones when notifying affected parties in multiple countries. Include cross-border scenarios in your incident response exercises. If your team has never practised identifying and communicating cross-border impact, they will struggle to do it under the pressure of a real event.