YTYK You think you know

Card 12 of 18 Incident reporting — the clocks ●○○ Foundational

Who receives the report

Reports go to the CSIRT or, where the Member State so provides, the competent authority. In Belgium both roles sit with the Centre for Cybersecurity Belgium, and the national single point of contact forwards cross-border cases.

Why it is like this

A single, known recipient is what makes a 24-hour clock workable. It also lets the CSIRT correlate reports across entities and warn the next target.

Not to be confused with

Your sector regulator. Financial entities in particular should check whether DORA applies, because where a sector-specific act covers the same ground, it takes precedence over NIS2's reporting.

In practice

A Belgian entity reports through the CCB's portal. If the incident spans several Member States, the CCB passes it on through the single point of contact — you do not report to each country yourself.

Source: Directive (EU) 2022/2555 (NIS2) — Art. 23(1) and Art. 10. Read on .

Predict Check yourself

A Belgian essential entity has a significant incident affecting customers in three Member States. Who does it notify?

  1. The CCB — which forwards to the others through the single point of contact.
  2. The competent authority of each affected Member State, separately.
  3. ENISA directly, because the incident is cross-border.
  4. The European Commission, through the NIS Cooperation Group.
Show the answer

The CCB — which forwards to the others through the single point of contact.

You report to your own CSIRT or competent authority. Cross-border propagation is the authorities' job, through the single point of contact under Article 10.