NIS2 · pillar 4 of 6
Incident reporting — the clocks
A significant incident starts three deadlines, all counted from awareness.
- 10 What makes an incident significant Only significant incidents are reportable. An incident is significant if it has caused or is capable of causing severe…
- 11 The three clocks: 24 hours, 72 hours, one month A significant incident starts three deadlines, all counted from the moment you become aware of it: an early warning…
- 12 Who receives the report Reports go to the CSIRT or, where the Member State so provides, the competent authority. In Belgium both roles sit with…
Start this pillar See the whole map
Sources: Directive (EU) 2022/2555 (NIS2), Belgian law of 26 April 2024 establishing a framework for the cybersecurity of networks and information systems, Centre for Cybersecurity Belgium — NIS2 and CyberFundamentals. Written from those texts and last checked on against reporting on them — not read line by line against the primary documents. Every card names the clause it comes from precisely so you can settle it at the source, and [email protected] is where a correction goes.