YTYK You think you know

Card 11 of 18 Incident reporting — the clocks ●●○ Working knowledge

The three clocks: 24 hours, 72 hours, one month

A significant incident starts three deadlines, all counted from the moment you become aware of it: an early warning within 24 hours, a notification within 72 hours, and a final report one month after that notification.

Why it is like this

The early warning is deliberately thin — is it suspected to be malicious, and could it have cross-border impact — so the CSIRT can alert others before you understand it yourself. Detail comes at 72 hours; lessons come at one month.

Not to be confused with

The GDPR's 72 hours. That clock runs to the data protection authority and only if personal data is at risk. If both apply, both run — in parallel, to different people.

In practice

Monday 09:00, a hospital confirms ransomware on imaging. Tuesday 09:00: early warning to the CCB, suspected malicious, no known cross-border impact. Thursday 09:00: notification with severity, impact and indicators of compromise. One month later: the final report, or a progress report if it is still running.

Source: Directive (EU) 2022/2555 (NIS2) — Art. 23(4). Read on .

Connects to

  • GDPR — GDPR Article 33's single 72-hour clock runs to the APD/GBA, and only when personal data is at risk. Under NIS2 the first clock is three times shorter and goes to someone else — and both can run at once.
Predict Check yourself

Monday 09:00, a Belgian hospital — an essential entity — confirms ransomware that has taken medical imaging offline. What must reach the CCB by Tuesday 09:00?

  1. An early warning: whether it is suspected to be malicious, and whether it could have cross-border impact.
  2. Nothing yet — the first deadline is 72 hours.
  3. The full notification: severity, impact and indicators of compromise.
  4. The final report — the incident is already confirmed.
Show the answer

An early warning: whether it is suspected to be malicious, and whether it could have cross-border impact.

The 24-hour early warning is deliberately thin: suspected malice and possible cross-border impact, nothing more. Severity and indicators come with the notification at 72 hours; the final report follows one month after that.