NIS2 Reporting Obligation
The obligation of affected entities to report significant security incidents to the competent authority within 24 hours of detection.
The NIS 2 Directive introduces a tiered mandatory reporting regime for significant security incidents. Essential and important entities must notify the competent national authority — in Germany, the Federal Office for Information Security (BSI) — as soon as they become aware of a significant incident. The obligation follows a three-stage timeline: an early warning within 24 hours, a full incident notification within 72 hours, and a final comprehensive report within one month.
An incident qualifies as "significant" under NIS 2 when it causes or is capable of causing severe operational disruption to the affected service, substantial financial loss, or impact on other natural or legal persons. The national authority may also be required to inform counterparts in other affected member states if the incident has cross-border implications.
The reporting obligation under NIS 2 operates independently of GDPR reporting obligations. Where an incident also involves a personal data breach, the organization must file separate notifications under GDPR (to the data protection authority within 72 hours) and under NIS 2. Organizations should therefore integrate both reporting workflows into their incident management procedures to avoid missing any deadlines.
Legal Basis
Art. 23 EU Directive 2022/2555 (NIS 2); NIS2UmsuCG (Germany); GDPR Art. 33 (parallel obligation for personal data breaches)
Practical Example
A telecommunications provider detects a cyberattack that disrupts voice services for approximately 50,000 customers. The security team classifies the incident as significant. Within 24 hours, an early warning is submitted to the BSI via the official reporting portal. A detailed incident notification follows within 72 hours, describing the attack vector, affected systems, and initial containment measures. One month later, a final report is submitted documenting the root cause, full impact, and remediation actions taken.