NIS2 incident notification (72 hours)

The NIS2 incident notification is the second step of the reporting imposed by Directive (EU) 2022/2555, known as NIS2: within 72 hours of becoming aware of a significant incident, the entity updates its early warning and gives an initial assessment of the incident. The directive, published in the Official Journal on December 27, 2022, sets this step in Article 23(4)(b): the initial assessment covers severity and impact, with indicators of compromise where available. Trust service providers get a derogation: for a significant incident affecting their trust services, the notification is due within 24 hours. The same incident often starts a second clock. If personal data is involved, Article 33 of Regulation (EU) 2016/679 requires the controller to notify the supervisory authority (the CNIL, Commission nationale de l'informatique et des libertés, in France) where feasible no later than 72 hours after becoming aware of the breach. Two authorities, two forms, and two starting points that do not line up: awareness of a significant incident on one side, awareness of a personal data breach on the other, sometimes established two days later by log review. A financial entity stacks DORA (Digital Operational Resilience Act) on top. On the policy side, the duplication mostly costs counsel hours, booked under incident response or notification costs depending on the wording. The harder issue sits elsewhere: regulatory investigation cover was often drafted around data protection statutes, and its definition of “regulatory proceeding” does not always reach a NIS2 authority asking questions after the notification. A NIS2 penalty then runs into the separate question of whether administrative fines are insurable. Also worth rereading: the indicators of compromise sent to the CSIRT (computer security incident response team) come from the panel forensic firm, and the policy has to allow them to be shared without tripping the confidentiality clause.