Knowledge · NIS2 · Article 23
24 hours, 72 hours, one month.
Significant incidents must be reported to the CSIRT or competent authority in stages: an early warning, an incident notification and a final report – with the clock starting when you become aware of the incident.
What it requires
In plain words.
- Early warning within 24 hours of becoming aware of a significant incident
- Incident notification within 72 hours, with an initial assessment
- Intermediate report on request
- Final report within one month of the notification
- Progress report if the incident is still ongoing, then a final report within one month of handling it
Plain-language summary of NIS2 Article 23 (Directive (EU) 2022/2555). Not legal advice – read the official text on EUR-Lex.
In practice
What it takes.
The deadlines only work if everyone knows when the clock started, who decides whether an incident is significant, and where the reports are kept.
- ProcessIncident triage with significance assessment and the three deadlines
- FormA security event report that captures time of awareness
- OwnersThe incident lead and the approver named up front
- EvidenceEvery report and decision logged with who and when
How it runs in Paragraf – on the same foundation as your contracts and processes.
Next step
See NIS2 article 23
with your own requirements.
Book a walkthrough. We show you the thread from this article to the Control, the owner and the evidence – in your own setup.