THE 3-TIERED NOTIFICATION WINDOW
24H
Early Warning
Initial notification focusing on the fact that an incident has occurred.
- Submission to CSIRT or Competent Authority
- Indicate if incident is highly significant (Art. 23.3)
- Provide basic technical indicators
72H
Incident Notification
Update of the initial warning with more technical detail.
- Initial assessment of severity and impact
- Indicators of Compromise (IoCs)
- Status of mitigation and recovery
1M
Final Report
A comprehensive detailed final report after incident closure.
- Root cause analysis
- Mitigation measures implemented
- Cross-border impact confirmation
SIGNIFICANT INCIDENT CRITERIA
⚠️
Severe Operational Disruption
The incident caused or is capable of causing severe operational disruption of services.
👥
Large-Scale User Impact
Affected numbers higher than sector-specific thresholds (e.g., >100,000 users).
⚖️
Other Entities Affected
The incident has affected other natural or legal persons by causing loss.