Three moments, not one deadline
Those searching for 'NIS2 reporting obligation 24 hours' usually come across the idea that an organisation must know and report everything within one day. This is not correct. Article 23 of the NIS2 Directive distinguishes three separate moments following a significant incident: an early warning within 24 hours, a more detailed report within 72 hours, and a final report within one month. Each moment requires something different, and the clock only starts running once the organisation becomes aware of the incident — not from the moment the incident actually occurred.
Important to know beforehand: this reporting obligation applies to organisations that are themselves designated as essential or important under NIS2, meaning entities from the sectors listed in Annexes I and II. Companies affected through the supply chain — the SME supplier that receives a security questionnaire from a major buyer — are not subject to this reporting obligation themselves. They may notice that a buyer asks how they handle incidents, but that is different from a legal reporting obligation to a competent authority. If you are unsure which category your organisation falls into, the check with a few questions will give you an initial indication.
The first moment: a warning, not an analysis
The first 24 hours are intended as an early signal, not as a full analysis. The Directive here refers to an early warning: a brief message indicating that there may be a significant incident, and whether there is a suspicion that the incident was caused by unlawful conduct or may have cross-border consequences. What may still be missing at this point — the precise cause, the scale, the systems involved — does not need to be there. This is precisely where the misconception lies: 24 hours is not a deadline to resolve or fully understand the incident, it is a deadline to report that something is wrong.
The second moment: an initial assessment
Within 72 hours, a report follows that goes beyond the first warning. An initial assessment of the incident is expected here, including its severity and impact, and where available the indicators pointing to the incident. This is also explicitly an intermediate step: the Directive recognises that 72 hours after becoming aware, an organisation often does not yet have the full picture. What is expected, however, is that the organisation can at that point demonstrate what it has established so far and what measures it has taken or is considering.
The third moment: the final report
The final report, no later than one month after the initial report, is where the full circumstances are documented: a detailed description of the incident, its severity and impact, the type of threat or underlying cause that led to the incident, the management measures taken and ongoing, and where relevant the cross-border impact. If the incident is still ongoing at that time, the Directive provides for an interim report and a later final report once the incident is resolved.
What the organisation itself must do, and what it must not
These three moments concern what is reported and when, not how an organisation technically handles the incident. Identifying the cause, isolating systems, forensic investigation — this is work for specialised parties and falls outside what a preparatory platform like secria.eu does. We prepare the texts needed at each of the three moments, based on what is already recorded in the organisation's cyber file regarding measures and responsibilities; submission is always made by the organisation itself, through the portal of the competent authority.
The exact procedure and portal differ by country, because each Member State transposes the Directive into its own legislation — in the Netherlands via the Cybersecurity Act. Details such as the precise notification process with the competent authority are therefore best verified with the competent authority itself or in the final national text. An overview of how secria.eu maintains sources and with which date can be found on the page on where our information comes from.
Why this is more than just remembering a deadline
The three timeframes are only achievable if an organization knows in advance who detects an incident, who reports it, and what information is already available for that purpose. This is precisely where the risk mitigation measures and the notification procedure intersect: an organization that maintains its measures as a living register, with an owner for each measure, does not need to start from scratch during an incident to determine who is responsible for what. More on how those measures relate to the notification obligation and other requirements can be found on the overview of topics per situation.
If you have questions about what exactly falls under a significant incident or how the notification obligation relates to your sector, the frequently asked questions page is a logical next step, alongside consultation with your competent authority or a lawyer for your specific situation.
If you first want to know whether your organization is subject to the notification obligation at all, take the free NIS2 check. It provides an indication of your position in a few questions, with explanation and a next step — without needing an account.