NIS2 incident reporting, in plain words
Last updated:
The EU NIS2 directive asks many organizations to report significant cyber incidents to their national authority on a fixed timeline. Here is what it asks, and where InfraFence helps you get it done.
Does it apply to you?
NIS2 covers medium and large organizations in sectors such as energy, transport, banking, health, water, digital infrastructure (cloud, hosting, data centres, DNS), managed IT and security services, public administration, manufacturing and digital services, and some smaller ones regardless of size, such as DNS and trust service providers. Each EU country applies it through its own national law and names its own authority, so check with them or your adviser.
What counts as a significant incident
One that has caused, or can cause, severe disruption of your services or financial loss for you, or considerable damage to other people or organizations. Deciding whether an incident is significant is up to you.
Three deadlines
Within 24 hours
Early warning
From when you become aware of a significant incident: say that it happened, whether it may be caused by unlawful or malicious acts, and whether it could have an impact in other countries.
Within 72 hours
Incident notification
Update the early warning with a first assessment: how severe the incident is, its impact, and indicators of compromise where available. The authority can ask for status updates in between.
Within one month
Final report
One month after the notification: a detailed description, the type of threat or root cause, the mitigation applied and still in progress, and any impact in other countries. If the incident is still going on, send a progress report then, and the final report within a month of handling it.
Personal data involved? GDPR Article 33
If the incident is also a personal data breach, the GDPR asks the controller to notify the data protection authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms. The two obligations run side by side, to different authorities.
How InfraFence helps
A timeline you don't have to rebuild
The events from your servers are already in one place: when the attack started, what was blocked, who logged in over SSH, which files changed, and every action taken, by a person or by AutoMode, with approvals and undos.
Drafts in minutes, in your language
From an incident or a time range, the AI drafts the early warning, the incident notification and the final report, and the GDPR Article 33 breach assessment, using that timeline. Included in Pro and AutoMode.
Yours to edit
Every draft can be edited and is saved in versions. Export it as Markdown or print it to PDF, then complete it with what only you know: the business impact, the people affected, the decisions taken.
The measures in place, documented
NIS2 also asks for risk-management measures such as vulnerability handling, access control and logging. Hardening checks, vulnerability scans, two-factor authentication, the activity log, the security score and the monthly report help you show what is in place on your servers.
What InfraFence does not do
- It does not decide whether an incident is significant or must be reported: you do.
- It does not send anything to an authority: you review, complete and submit the reports yourself.
- The drafts are not legal advice and do not make you compliant on their own.
- It only sees what the agent sees on your servers: other systems, people and suppliers are up to you.
This page is a plain-language summary of Article 23 of Directive (EU) 2022/2555 (NIS2) and Article 33 of Regulation (EU) 2016/679 (GDPR), for information only. National laws differ in the details: for your obligations, rely on the official texts, your national authority and your adviser.
Be ready before the clock starts
Start free on one server. Report drafts come with Pro and AutoMode; every new account gets 14 days of AutoMode free, no card.