! ALERT: Reporting Pitfalls

Avoiding common regulatory errors in the Article 23 notification windows (24H/72H).

DECISION_TOOL // V1.0

Use this classifier to determine if you MUST notify the CSIRT under NIS2 Article 23.

Incident has caused severe operational disruption of services

Incident has affected >100,000 users or significant market share

Incident has cross-border impact (affects other EU states)

Incident involves a threat to public safety or critical infrastructure

📋

Criteria not yet met for directive-level reporting. Monitor and document internally.

PRIORITY_ALPHA // FIRST_24H

T+1H: Confirm Scope

Identify if it belongs to the "Significant" category.

T+2H: National CSIRT Contact

Verify contact channels for your local regulator.

T+23H: Early Warning (24H)

Submit initial notification via standardized template.

T+71H: Incident Notification (72H)

Submit updated report with IOCs and impact assessment.

Common Regulatory Blindspots

Delaying the 24h warning because you don't know the root cause yet.

Treating every minor BGP flap as a NIS2 incident.

Sending free-form prose to the CSIRT.