NIS2 final incident report (one month)

The final incident report is the last reporting step under Directive (EU) 2022/2555, known as NIS2: no later than one month after the incident notification, the entity files a report on the incident, its likely root cause, mitigation measures and cross-border impact. On May 26, 2020, a federal magistrate judge in Virginia ordered Capital One to hand class action plaintiffs the report Mandiant wrote after the March 2019 breach. The district court affirmed on June 25: the root cause written by a forensic firm did not stay between the company and its lawyers. NIS2 makes that text mandatory and sends it to a regulator. Article 23(4) of Directive (EU) 2022/2555 provides in point (c) for an intermediate report on relevant status updates, at the request of the CSIRT (computer security incident response team) or competent authority. The point (d) final report, due one month after the point (b) notification, describes the incident in detail with its severity and impact, the type of threat or root cause that likely triggered it, and applied and ongoing mitigation measures. Under point (e), if the incident is still ongoing at that date, the entity files a progress report, then the final report within one month of its handling of the incident. One month is short for a root cause analysis on an attacker who sat in the network for weeks. For the underwriter, it stretches the forensic bill past containment, and a policy that limits investigation costs to determining “the extent of the incident” is open to argument once the report demands the cause. The second friction is the Capital One one: the final report sets an official version of the cause that regulators, plaintiffs and the carrier's adjuster will all read when weighing an unpatched-vulnerability exclusion. Practice separates the privileged technical report from the summary filed with the authority. One caveat: national transposition can specify the format, and an official Belgian release speaks of thirty days.