NIS2 Art. 23: reporting significant incidents, from the 24-hour early warning to the final report

Who reports, to whom and what

Article 23(1) of the NIS2 Directive requires essential and important entities to notify the CSIRT, or where applicable the competent authority, without undue delay of any incident that has a significant impact on the provision of their services. In Italy notifications go to CSIRT Italia, established within the National Cybersecurity Agency.

Where appropriate, the entity also notifies the recipients of its services of significant incidents that are likely to adversely affect the provision of those services. In the event of a significant cyber threat, Article 23(2) requires entities to communicate to potentially affected recipients the measures they can take in response.

The Directive states that the mere act of notification does not subject the entity to increased liability.

When an incident is significant: Article 23(3)

Article 23(3) considers an incident significant if it:

• has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned;
• has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.

How to read the criteria

Both criteria include potential impact ("is capable of"): an incident can be significant even if the damage has not yet occurred. The Directive allows the Commission to specify the cases further through implementing acts, and national authorities may issue their own guidance: internal classification criteria should be aligned with the current version of these documents.

A workable internal criterion translates "severe" and "considerable" into thresholds the organisation can measure: duration of service unavailability, number of users affected, data compromised, estimated financial loss.

The communications required by Article 23(4)

When the deadlines start

• The early warning and the notification run from the moment the entity becomes aware of the significant incident. It is good practice to record the date, time and author of the significance decision.
• The one-month deadline for the final report runs from the incident notification (72 hours), not from the incident itself.
• The CSIRT responds without undue delay and, where possible, within 24 hours of the early warning, with initial feedback and, on request, guidance or operational advice (Article 23(5)).

Parallel obligations to coordinate

• GDPR Article 33: where the incident involves a personal data breach, the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours. This is a separate notification with its own recipient and content.
• DORA: financial entities report major ICT-related incidents under Article 19 of DORA, which takes precedence on these matters as sector-specific legislation.
• Contracts: customers and partners may be entitled to notice within their own contractual deadlines, which are often shorter.

Checklist: preparing the process

• Written significance criteria with measurable thresholds, approved and aligned with current national guidance.
• Defined roles: who classifies, who decides on significance, who signs and sends each communication, with deputies.
• Access to the notification channel tested in advance, with credentials available to more than one person.
• Templates ready for the early warning, notification and final report, with the fields required by Article 23(4).
• Incident register recording the times of detection, awareness, decision and submission of each communication.
• Coordination with the data protection officer for personal data breaches.
• List of service recipients to be informed, with communication templates for them.
• An exercise at least once a year that measures actual timings against 24 hours, 72 hours and one month.
• A check of the notification terms in contracts with critical vendors, since awareness of an incident may come from them.

In EVIDEVO

In Incidents and notifications each incident records its classification, the significance decision with date and author, and the early warning, notification and final report deadlines calculated from that point. Personal data breaches are tracked in the same register against the 72-hour count set by GDPR Article 33.