The NIS2 early warning: what to send within 24 hours, and to whom

Article 23 of the directive asks essential and important entities to notify their CSIRT or, where applicable, their competent authority of every significant incident, in stages:

Two details change how you work. The clock starts when you become aware of the significant incident, not when the attack began. And 24 hours is a ceiling: the rule is "without undue delay". Within 24 hours of the early warning, where possible, the CSIRT or authority replies with initial feedback and, on request, guidance on mitigation (Art. 23(5)). Trust service providers have a shorter deadline for the incident notification too: 24 hours.

Under Article 23(3), an incident is significant if:

• it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity; or
• it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.

For digital providers (DNS, TLD registries, cloud, data centres, CDNs, managed service and managed security service providers, online marketplaces, search engines, social networks and trust services) Implementing Regulation (EU) 2024/2690 makes this measurable. Article 3 lists general criteria: a direct financial loss above 500,000 euros or 5% of annual turnover, whichever is lower; exfiltration of trade secrets; a death or considerable damage to someone's health; or a successful, suspectedly malicious and unauthorised access to network and information systems capable of causing severe operational disruption. Article 4 adds recurring incidents: at least twice in six months, with the same apparent root cause, together reaching the financial threshold. Articles 5 to 14 add criteria per type of provider; for managed service providers, for example, a service completely unavailable for more than 30 minutes (Article 10).

National authorities can add their own definitions, so check your country's (Italy, for example, has its own list in the ACN determinations). Two things hold everywhere: deciding whether an incident is significant is up to you, and an attack that was blocked is not automatically an incident. The directive calls an event that was prevented from materialising a "near miss" (Article 6), which you can report voluntarily (Article 30).

The directive asks for little: whether the incident looks unlawful or malicious, and whether it could affect other countries. In practice, national forms ask for a few more facts, and the authority can only help if it can reach you. A useful early warning has:

1. Who you are: the organisation, its sector, and a contact person reachable around the clock.
2. When: the date and time of detection and of awareness, in UTC or with the time zone.
3. What you have seen so far: a few factual lines, such as unusual access to a server, files encrypted, a service down, data sent to an unknown address.
4. Suspected cause: whether you suspect unlawful or malicious acts, and why.
5. Cross-border impact: whether services, customers or systems in other member states could be affected.
6. Measures already taken: isolation, password and key rotation, blocked addresses, restored backups.
7. Next steps, and whether you want guidance or technical support from the CSIRT.

Speed over completeness: write what you know, mark what you don't know yet, and complete it in the incident notification within 72 hours. An early warning that arrives late because it was trying to be perfect defeats its purpose.

Each member state names its CSIRT and its competent authority, and some have changed the stages or deadlines. The situation as of November 2026 in the countries of the languages of this site:

For the other member states, the European Commission keeps a page per country with the national contacts: check its update date, then the official national sources. If you operate in several countries, the general rule is the country where you are established; managed service providers, cloud and data centre providers and some other digital providers fall under the country of their main establishment in the Union (Article 26).

Twenty-four hours is short only if you find out late, or if you have to rebuild what happened by hand. What makes the deadline realistic is in place before the incident:

• Alerts that reach a person: critical events go to a channel someone reads, also at night and at weekends, not to an unread mailbox.
• One timeline: the events of every server in one place, with times, source addresses, logins and the actions taken, so the first lines of the early warning are a matter of reading, not of collecting logs.
• A decision-maker named in advance: who decides whether the incident is significant, and who signs and sends the report.
• The authority's channel ready: registration done where it is required, access to the portal tested, the CSIRT's contacts at hand.
• Suppliers in the loop: if a supplier manages your servers, the contract says how quickly they tell you. Their delay is part of your 24 hours.

InfraFence covers the Linux servers where its agent runs:

• Alerts: by email on every plan; Slack, Discord, Telegram and signed webhooks from the Basic plan, with a minimum severity and categories per channel. See Alerts.
• The timeline: attacks, bans, SSH logins, modified files, malware findings, and every action taken by a person or by AutoMode, with approvals and undos. See Events and activity.
• Report drafts: under Compliance (Pro and AutoMode), the NIS2 early warning, incident notification and final report are drafted from an incident of the last 7 days or a time range of up to 31 days, with your notes and in the language you choose. The draft keeps blocked attempts apart from a confirmed compromise and marks what it cannot know, such as company details and business impact, as a placeholder to complete. Drafts are versioned and can be downloaded as Markdown or printed to PDF. See Monthly and NIS2 reports.

The drafts follow the structure of Article 23, not a national form: copy the text into your country's form or portal. To write a draft, the timeline and your notes are sent to an external text-generation provider, and the page says so before you start.

What it does not do: it doesn't decide whether an incident is significant, it sends nothing to any authority or CSIRT, and it only sees the servers where the agent runs. Event history is 30 days on Starter and 90 days on the paid plans. The drafts are not legal advice and do not make you compliant on their own. If personal data is involved, read NIS2 and GDPR too.

• Directive (EU) 2022/2555 (NIS2), on EUR-Lex: Articles 6, 23, 26 and 30.
• Commission Implementing Regulation (EU) 2024/2690, on EUR-Lex: Articles 3, 4 and 10.
• Italy: D.Lgs. 138/2024, Article 25, on Normattiva, and the ACN determination 379907/2025.
• Germany: § 32 BSIG and the BSI's page on the reporting obligation.
• France: the bill's file at the National Assembly.
• Spain: Royal Decree-law 12/2018, on the BOE, and the Ministry of the Interior on the draft bill.
• Portugal: Decree-Law 125/2025, on the Diário da República, Articles 40 to 44 of the annexed regime.
• European Commission, NIS2 transposition in EU countries.