What must we report under NIS2 after a cyber incident?

Essential or important entity

Essential and important entities in the sectors of Annexes I and II, generally medium-sized or larger.

Yes, significant incidents must be reported to the CSIRT or competent authority.

Submit an early warning, an incident notification and a final report; management bodies approve and oversee risk measures.

high (fine_cap_pct_turnover)

1. Classify the incident as significant or not
2. Send the early warning
3. Send the incident notification
4. Submit the final report

Early warning within 24 hours, notification within 72 hours, final report within one month of the notification.

• NIS2 Art. 23(4)
• NIS2 Art. 20
• NIS2 Art. 34(4)

sha256 1b4d1eb5ef0ef54dd26cfcd1ae47d1ca1e5fb964ee1609ca53cc2d821f660536 · read 2026-10-15 · Source: NovaCopilot

• Must a manufacturer report exploited vulnerabilities in its products?

• eu:nis2 (action_kit)
• agent:eu:business:cra-vulnerability-reporting (business_agent)