Reporting obligations
Summary
Entities must notify significant incidents to the CSIRT or competent authority via a phased timeline: early warning within 24 hours, incident notification within 72 hours, and a final report within one month.
incident reportingearly warning72 hours24 hoursfinal reportcsirt
Read the full official text: https://eur-lex.europa.eu/eli/dir/2022/2555/oj
← Article 21
Cybersecurity risk-management measures
Article 24 →
Use of European cybersecurity certification schemes
Track NIS2 article 23 as evidence
eurocompliant maps this obligation to a checklist task and the evidence that satisfies it, alongside every other framework you follow.
Start free trial