NIS2 early warning (24 hours)
The first report an essential or important entity sends to the CSIRT (computer security incident response team) or competent authority, no later than 24 hours after becoming aware of a significant incident, stating whether malicious action is suspected and whether the impact could cross borders.
The NIS2 early warning is the first report an essential or important entity sends to the CSIRT (computer security incident response team) or competent authority, no later than 24 hours after becoming aware of a significant incident. Since October 18, 2024, a Belgian entity subject to the law of April 26, 2024 that discovers a significant incident at 11 p.m. on a Friday has until 11 p.m. Saturday to file its early warning with Belgium's national cybersecurity agency, the CCB, through notif.safeonweb.be. The rule comes from Article 23(4)(a) of Directive (EU) 2022/2555, which requires the warning “without undue delay”. Where applicable, it indicates whether the incident is suspected of being caused by unlawful or malicious acts and whether it could have a cross-border impact. The clock runs from awareness, not from occurrence. The required content is thin by design: at hour 24, nobody knows yet whether the team is facing ransomware or a misconfiguration. The early warning opens a cascade (incident notification at 72 hours, final report at one month), and whether an incident is significant turns on the criteria of paragraph 3 or, for digital providers, on Implementing Regulation (EU) 2024/2690. For the cyber underwriter, the question is who pays for the hours before the warning goes out. The breach coach and the first forensic examiner work before anyone is sure; if the policy triggers incident response costs on a “confirmed” incident, the night spent qualifying the event falls into a gap. Recent wordings reach an “actual or suspected” incident, and that is the first word a claims lawyer reads. A second friction point: the early warning is a statement to a regulator, it fixes a timeline the carrier's adjuster will later reread, and a prior-consent clause sits badly with a 24-hour deadline. One caveat: transposition varies, and some member states add fields or channels of their own.
Textbook case: Logivert, a fictional carrier classified as an important entity, finds its servers encrypted at 6 a.m. on a Monday; the early warning goes out at 5 a.m. Tuesday. In between come 18 hours of forensics at €400 (€7,200) and 6 hours of breach coaching at €500 (€3,000), for €10,200. The policy triggers response costs on a “confirmed” incident, and confirmation is dated noon Tuesday: the €10,200 spent before that hour becomes the first point argued on the claim.
early warning, NIS2 early warning, 24-hour early warning, NIS2 24-hour notice, Article 23(4)(a) NIS2
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.