How does NIS2 incident reporting work?

Direct answer

Under Article 23 of NIS2, essential and important entities must report significant incidents to their national CSIRT or competent authority in stages: an early warning within 24 hours of becoming aware of the incident, a fuller incident notification within 72 hours, and a final report within one month of that notification. An incident is significant if it has caused or is capable of causing serious operational disruption or financial loss, or has affected other people through considerable material or non-material damage. These windows are fixed in Article 23(4) of the directive, so the 24-hour, 72-hour, and one-month deadlines are the same in every member state. What national transposition changes is the authority or CSIRT you report to and the reporting mechanics, so confirm your reporting route for the country where you operate. The staged structure exists so authorities get an early signal quickly, then a complete picture as the situation resolves. The reporting clock only starts once you determine an incident is significant, which is why fast, accurate classification matters as much as the reporting itself. NIS2 sets out when an incident is significant, based on the disruption or loss it causes or could cause, and the harm to others. National transposition and guidance sharpen these thresholds. Classifying correctly is the gate: misjudge it and you either over-report routine events or, worse, miss the clock on a reportable one. Reporting is a sequence, not a single filing: an early warning within 24 hours of awareness, a notification within 72 hours with a fuller assessment, and a final report within one month of that notification covering root cause and mitigation. If the incident is still open at one month, you file a progress report and a final report once it is resolved. The timeframes come from Article 23(4) of the directive and do not change by member state; national implementation sets the authority you report to and the mechanics, not the windows.