Home
Suite features
NIS2 incident reporting

Suite feature · NIS2 incident register

NIS2 incident reporting against the clock: 24 hours, 72 hours, one month

Feature page · Article 23 NIS2 incident register · Last reviewed: 27 September 2026

NIS2 incident reporting runs on three clocks under Article 23 of Directive (EU) 2022/2555: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, a final report no later than one month after that notification. The Regingada Compliance Suite's incident register counts down each stage per incident — the final report as 30 days from awareness, not from the notification. Significance it leaves to you.

Open NIS2 in the suite How it works

NIS2 · Art. 23(4)(a), (b), (d)
Live countdowns · 30 s refresh
Art. 23(3) significance test · not modelled
Filing with a CSIRT · not included

The suite NIS2 incident register, dark theme: two synthetic incidents marked Critical and High, each with the Art. 23 stages early warning (24h), notification (72h) and final report (1 month); on the first, the early warning is ticked done, the other stages count down — NIS2 Twin · Incident Reporting (Art. 23) · synthetic entries

1 · The question it answers

What does NIS2 incident reporting require, and by when?

Essential and important entities — the two NIS2 tiers, set by sector and size (Art. 3) — notify each significant incident to their CSIRT (national computer security incident response team) or competent authority, without undue delay and in stages (Art. 23(1) and (4) NIS2; text on EUR-Lex). National transposition fixes the portal and the forms.

24 hoursEarly warning · Art. 23(4)(a) — suspected unlawful or malicious cause, possible cross-border impact.
72 hoursIncident notification · Art. 23(4)(b) — initial assessment, indicators of compromise where available.
On requestIntermediate report · Art. 23(4)(c) — when the CSIRT or authority asks.
One monthNIS2 final report, no later than one month after the notification · Art. 23(4)(d) — root cause or threat type, mitigation, cross-border impact.

Significance, the competent CSIRT and each report's content are judgements. Keeping three dates straight across several incidents is bookkeeping — the narrow job the register does.

2 · How it works

From the deep link to a running clock

Open /suite/#nis2. Then:

Confirm the legal notice. First visit only — do it before an incident, since the notice, the welcome screen and the entity step stand between the deep link and the register.
Choose “NIS2 · Cyber Security”. The card sits on the welcome screen. NIS2 has no quick check; the card opens the NIS2 Twin, the suite's NIS2 workspace.
Add your entity. In “Entity Portfolio”, enter a name, an Annex I or II sector and a size band. The register unlocks only for an essential or important classification and follows the first entity listed — enter the in-scope one first.
Open “Incident Reporting (Art. 23)”. It sits in the NIS2 sidebar. Enter the “Time of knowledge”: the moment you became aware, in your browser's time zone. Left empty, it takes the current moment, which pushes every deadline later if you knew earlier. Pick a severity and click “+ Add incident”.
Tick each stage as it goes out. Each stage counts down (“in 2d 18h 40m”, refreshed every 30 seconds), then reads “overdue”; a ticked stage reads “done”. With all three ticked, the incident turns from “Open” to “Completed”.

3 · What you get

What the register shows, and on which legal basis

Capability	Legal basis	Output
Incident entry	Art. 23(1), (4) NIS2	Card with detection time and a Low / Medium / High / Critical label
Early-warning clock	Art. 23(4)(a)	Countdown to awareness + 24 hours
Notification clock	Art. 23(4)(b)	Countdown to awareness + 72 hours
Final-report stage	Art. 23(4)(d)	Countdown to awareness + 720 hours — see the limits
Obligation card	Art. 23 NIS2 · cross-references Art. 33, 34 GDPR	Under “NIS2 Obligations”: paraphrase, addressee and four tasks — reporting playbook, severity thresholds, CSIRT escalation path, final-report template — named, not written

4 · Worked example

One hypothetical incident, walked through

Take the hypothetical US managed service provider from the NIS2 compliance tool page, where the suite indicates “Important entity (Art. 3(2))” — a draft reading of size and sector, not a finding. On Monday 5 October 2026 at 09:30 its team becomes aware of ransomware on a customer-facing system and adds the incident. For managed service providers, significance is judged under Implementing Regulation (EU) 2024/2690; the example assumes the test is met.

6 Oct · 09:30Early warning due. It went out the evening before and is ticked.
8 Oct · 09:30Incident notification due. The team files it on 6 October at 16:00 and ticks the stage.
4 Nov · 08:30The register's final-report countdown runs out: 720 hours after awareness, with the clocks going back in between.
6 NovThe statutory reference: one month after the notification went out.

Here the register runs out about two days early — harmless. Which Member State's CSIRT receives the reports turns on where the provider's EU representative is established (Art. 26(3) NIS2), a question the suite does not test.

5 · Parallel clocks

GDPR vs NIS2 breach notification: one incident, two chains?

Often. If the incident is also a personal data breach, the controller notifies under Art. 33 GDPR, where feasible within 72 hours — without an EU establishment, each authority concerned (EDPB Guidelines 9/2022); a processor informs its controller (Art. 33(2)). High-risk AI providers may, once those duties apply, owe an Art. 73 AI Act report. In cross-regulation mode, the Collision Resolver pairs these. Since 11 September 2026, manufacturers also report under the Cyber Resilience Act (Art. 14).

6 · What it does not do

Seven limits of the register

No significance test: every entry starts all three clocks, NIS2 significant incident or not (Art. 23(3); Implementing Regulation (EU) 2024/2690). Severity is a label you choose.
The final-report stage runs 720 hours from awareness, not one month from the notification. Usually it runs out first, but a short month such as February can reverse that. The register shows time remaining, not due dates.
A ticked stage stores no timestamp or content; an incident has no description or entity link. Entries cannot be edited: to fix the time of knowledge, remove the entry (the × deletes without asking) and re-add it, losing its ticks. It is not an evidence log.
Not modelled: the intermediate report (Art. 23(4)(c)), the progress report (Art. 23(4)(e)), the 24-hour notification for trust service providers (Art. 23(4), second subparagraph), and informing recipients of your services (Art. 23(1), (2)).
No reminders: nothing alerts you as a stage nears its deadline, and the countdown moves only while the suite is open on the NIS2 view.
No forms, templates or filing; national portals are not in the suite. For banks and financial market infrastructures, the suite only notes that DORA (the Digital Operational Resilience Act, Regulation (EU) 2022/2554) may displace these duties. It runs no DORA clock.
The register lives in one browser's local storage: no account, no sharing, no export. Deleting your profile in the suite erases it with the entity portfolio — keep your own incident record. Details in the Trust Center.

Questions

Frequently asked questions

What has to be reported within 24 hours under NIS2?

An early warning to the CSIRT or, where applicable, the competent authority (Art. 23(4)(a) NIS2). The NIS2 24-hour early warning is deliberately brief: where applicable, it says whether the incident is suspected of being caused by unlawful or malicious acts and whether it could have a cross-border impact.

When does the NIS2 72-hour clock start?

When the entity becomes aware of the significant incident — not when the early warning was sent (Art. 23(4)(b) NIS2). The NIS2 72-hour incident notification gives an initial assessment of severity and impact and, where available, indicators of compromise. In the register, both clocks run from the time of knowledge you enter.

When is the NIS2 final report due?

Not later than one month after the submission of the incident notification (Art. 23(4)(d) NIS2). If the incident is still ongoing then, a progress report is due and the final report follows within one month of its handling (Art. 23(4)(e)). The register counts 720 hours from awareness instead; check the statutory date against your actual submission.

What counts as a significant incident under NIS2?

One that has caused or can cause severe operational disruption of the services or financial loss for the entity, or considerable material or non-material damage to others (Art. 23(3) NIS2). For the digital providers it covers — among them cloud, data-centre, managed and managed security service providers — Implementing Regulation (EU) 2024/2690 specifies when an incident is significant. The suite applies neither test; severity is your own label.

If a breach involves personal data, do we report under both NIS2 and the GDPR?

Often, yes. NIS2 reports go to the CSIRT or competent authority. A controller notifies a personal data breach under Art. 33 GDPR, where feasible within 72 hours, unless it is unlikely to result in a risk to people's rights and freedoms — without an EU establishment, to each authority where affected people live (EDPB Guidelines 9/2022). A processor informs its controller (Art. 33(2)). Whether both apply is a legal assessment. In cross-regulation mode, the pairing sits under “Collision Resolver”, filter “Cumulation”.

Does the suite send the report to the authority?

No. The register keeps deadlines; it has no report forms, no templates and no connection to any CSIRT, authority or reporting platform. Drafting and filing stay with your team; the law firm Theo Funk can assess the content under a separate mandate.

7 · Where the software stops

The clock is the software's; the report is not

The register counts time. It cannot tell you whether the event is significant, which Member State's CSIRT is competent, what the early warning should say, or whether a GDPR notification is also due — judgements made under time pressure.

Non-EU providers of DNS, TLD, domain-registration, cloud, data-centre, content-delivery, managed or managed security services, online marketplaces, search engines or social networks within NIS2 must designate a representative in a Member State where they offer services (Art. 26(3)). Where that includes Germany, Regingada UG (haftungsbeschränkt) can hold the NIS2 representative role: an address the authority and the CSIRT can reach — not legal advice. The reports remain your own.

The judgements are legal work: under a separate mandate, the law firm Theo Funk can assess each of them.

Set up the register in the suite