YTYK You think you know

Card 10 of 18 Incident reporting — the clocks ●●○ Working knowledge

What makes an incident significant

Only significant incidents are reportable. An incident is significant if it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity, or if it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.

Why it is like this

Reporting everything would drown the CSIRTs and tell them nothing. The threshold is written around consequences rather than causes so that it survives new attack techniques.

Not to be confused with

A severity rating from your own incident process. Your P1 and the directive's 'significant' are different scales, and 'capable of causing' means a contained incident can still be reportable.

In practice

Ransomware encrypts a backup server but production is untouched. No operational disruption occurred — but if it was capable of causing severe disruption, the clock has started.

Source: Directive (EU) 2022/2555 (NIS2) — Art. 23(3). Read on .

Predict Check yourself

An intrusion is detected and contained before any service degrades. Reportable?

  1. Potentially yes — the test includes incidents *capable of* causing severe disruption, not only those that did.
  2. No — nothing was disrupted, so by definition it was not significant.
  3. Only if personal data was involved.
  4. Only if the entity is an essential entity.
Show the answer

Potentially yes — the test includes incidents *capable of* causing severe disruption, not only those that did.

Article 23(3) reads 'has caused or is capable of causing'. Containment is not a defence against the threshold; it is a fact for the notification.