How do we write a NIS2 early warning when we still know very little?

Start

A significant incident is under way, and the facts are thin

The early warning is the first of NIS2's reports to the CSIRT or competent authority. It is short on purpose. A common mistake is waiting for the cause before sending it. The cause belongs in the final report. A short early warning on time is worth more than a full one late.

• Then: Fix the deadline: 24 hours from awareness

Step

Fix the deadline: 24 hours from awareness

Awareness is the time the incident was declared, from the case log, unless the record shows reasonable certainty earlier. The clock does not wait for the decision to report. It runs on calendar hours, through nights and weekends. Where national law sets a shorter clock, use that. If the incident only becomes reportable later, the clock starts when the record shows the deciding fact was known.

• Then: Is the NIS2 decision recorded as reportable?

Decision

Is the NIS2 decision recorded as reportable?

The executive incident lead decides whether to report, on the incident manager's screen, within 4 hours of declaration in the pack's default. The decision is Reportable, Not reportable, or Not settled when a fact the test needs is still unknown. A Not settled decision always carries the time it will be revisited.

• Yes, reportable: Call the signatory on duty and open the fact base
• Not settled yet: Are we within 6 hours of the deadline?
• No, not reportable: No early warning; revisit the decision at every update

Outcome

No early warning; revisit the decision at every update

Record the reasons and the facts relied on. A decision not to report is revisited at each incident update and at once when a fact changes, and the result is recorded even when unchanged. If the incident becomes reportable later, its clock starts when the record shows the deciding fact was known.

Decision

Are we within 6 hours of the deadline?

The pack sets a doubt point 6 hours before the first deadline: 18 hours after awareness for the early warning. From then, an unsettled decision is treated as reportable and the report goes on the facts known, saying the assessment continues. A report can be updated or withdrawn. A missed deadline cannot be undone.

• Yes, or not known: treat as reportable: Call the signatory on duty and open the fact base
• No: Set the revisit time, and start drafting anyway

Step

Set the revisit time, and start drafting anyway

Record the decision as Not settled, with the time it will be revisited, never later than the doubt point. The pack has the signatory briefed for a Not settled decision as for a Reportable one. Starting the draft now is a sensible precaution, so that it is ready if the decision settles as reportable or the doubt point arrives first.

• Then: Is the NIS2 decision recorded as reportable? (back to an earlier step)

Step

Call the signatory on duty and open the fact base

Call the notification signatory on duty, since a message alone is not enough out of hours, and give the due time from the log. The signatory checks at once that they can sign in to the channel; if not, the deputy takes over now. Open the fact base: the one record every report is drafted from, kept by the incident manager, with unknowns written as unknown and estimates marked.

• Then: Fill the header: who we are, and who to call now

Step

Fill the header: who we are, and who to call now

The entity's name and identifier exactly as the authority holds them from registration, and the sector and services, ideally filled in before any incident. A contact who can answer tonight and at the weekend, usually the incident manager, and a deputy. If the incident manager cannot be reached, name the deputy. Our case number; the authority's reference is "none yet".

• Then: Say what has happened, in two to five sentences of fact

Step

Say what has happened, in two to five sentences of fact

What was seen, which systems or sites, what the attacker or fault has done, and what has been done to stop it. Facts, not theories. Write for an analyst who has never heard of you. Where little is known, say what is known and that the assessment continues.

• Then: Give the key times; awareness is always known

Step

Give the key times; awareness is always known

Detection, awareness and, once reached, containment. When the incident started is often unknown: write "not yet known". The awareness time is never unknown, because it is in the case log.

• Then: Answer both questions: malicious act, cross-border impact

Step

Answer both questions: malicious act, cross-border impact

Is an unlawful or malicious act suspected? Answer Yes, No or Not yet known, with the one fact behind it, such as a ransom note or an attacker's sign-in, and say whether a crime report has been or will be made. Never guess who the attacker is. Could there be a cross-border impact? Name the Member States, or write "not yet known" and what you are checking. A Yes can become a No in the next report.

• Then: List what is not yet known, and ask the CSIRT for help

Step

List what is not yet known, and ask the CSIRT for help

Name the open questions and the report each will follow in, so the authority knows what is coming and need not ask. In the pack's worked example: how the attacker got in, whether data was taken, and the indicators of compromise. The CSIRT replies to an early warning with initial feedback and gives advice on request. Ask for what would help, such as malware analysis, or write "none at present".

• Then: Can it go before the 24-hour deadline?

Decision

Can it go before the 24-hour deadline?

Look at the time left against the steps still to come: review, approval, an optional second check and submission. If the deadline cannot be met, waiting does not help.

• Yes: Has Legal reviewed it within 60 minutes?
• No: Give the reasons for the delay, and tell the lead at once

Step

Give the reasons for the delay, and tell the lead at once

A report that will miss its deadline is still made as soon as possible, and says why it is late in one or two plain sentences. It is never held back to avoid a deadline. Tell the executive incident lead about the missed deadline at once. It still goes through review, approval and a signatory, with no time lost waiting.

• Then: Has Legal reviewed it within 60 minutes?

Decision

Has Legal reviewed it within 60 minutes?

Legal checks that every fact is in the fact base, that unknowns and estimates are marked, and that the draft says no more than it needs about cause or fault. Legal does not rewrite facts or hold a report. The time-box is 60 minutes in the pack's default, from when the draft is sent, by night as by day.

• Yes: The executive incident lead approves it in writing
• No, the time ran out: Go on the approver's decision, and log the lapse

Step

Go on the approver's decision, and log the lapse

When the time-box runs out, the draft goes to the approver without a review, and the log records that the review lapsed. A legal review running past the deadline is one of the pack's named pitfalls.

• Then: The executive incident lead approves it in writing

Step

The executive incident lead approves it in writing

The pack's approver for NIS2 report content is the executive incident lead. Approval is in writing with its time, by email or in the case channel. Out of hours, a phone approval is written into the log by the incident manager and confirmed in writing afterwards. If the approver cannot be reached, their named deputy approves.

• Then: Are at least 60 minutes left before the deadline?

Decision

Are at least 60 minutes left before the deadline?

The pack asks for a second check where at least 60 minutes remain before the deadline, its default. With less time left, the signatory submits without it and logs that it was skipped and why.

• Yes: A second person checks it against the fact base
• No: skip it, and log why: Submitted by a signatory, logged, next deadline set

Step

A second person checks it against the fact base

Someone other than the drafter compares the approved text with the fact base line by line: times, numbers, names and systems. Check too that nothing in it contradicts a notice already sent to customers.

• Then: Submitted by a signatory, logged, next deadline set

Outcome

Submitted by a signatory, logged, next deadline set

The signatory copies the content into the authority's portal and submits it under their own account. They log the time, channel, a copy of what was sent and the authority's reference; every later report quotes it. They set the incident notification's due time, 72 hours from awareness, in the log and two calendars. Log the CSIRT's feedback and act on it.