If we can't tell whether an incident is reportable and the deadline is close, then what?

Start

We can't yet tell whether a report is due

The clocks are short and the tests turn on facts that often arrive late: whether data was taken, how long a service will be down, what the loss will be. The cost of the two errors is not equal. A report on incomplete facts can be corrected, updated or withdrawn. A missed deadline is a breach of the law that no later report repairs. So when time runs short, the default is to report.

• Then: Fix awareness, and each regime's first deadline

Step

Fix awareness, and each regime's first deadline

Every clock that runs from awareness starts at declaration, or earlier where the record shows reasonable certainty earlier. It does not wait for your decision. First deadlines: the NIS2 early warning within 24 hours of awareness; the DORA initial notification within 4 hours of classifying as major and no later than 24 hours after awareness, or, where it is classified as major more than 24 hours after awareness, within 4 hours of that classification; the GDPR notification within 72 hours of awareness, where feasible.

• Then: Decide every regime you can on the facts known now

Step

Decide every regime you can on the facts known now

Waiting for the investigation is the commonest mistake. Each regime is decided separately within 4 hours of declaration, the pack's default. Test what the incident could do as well as what it has done; spreading ransomware can make an incident significant before any service stops. Mark each fact still unknown and name who is finding it out.

• Then: Does the answer turn on a fact still unknown?

Decision

Does the answer turn on a fact still unknown?

Ask it per regime. If the facts you have already meet the test, the regime is Reportable now, whatever else is unknown. If they clearly do not, and no unknown could change that, it is Not reportable. Only a test whose answer depends on the missing fact is unsettled.

• Yes, or not sure: Record Not settled: the missing fact, who finds it, when to revisit
• No: Record the decision now, with its reasons

Outcome

Record the decision now, with its reasons

Record the outcome, the indicators or thresholds met or not, the facts relied on, who decided and when. A decision to report is the executive incident lead's, and so is a decision not to report a Severity 1 or 2 incident. A decision not to report is revisited at every update, so a later fact can still change it.

Step

Record Not settled: the missing fact, who finds it, when to revisit

Not settled is a recorded outcome, not a gap in the log. It always carries the time it will be revisited, and that time falls before the doubt point. In the pack's example, a GDPR decision on ransomware was Not settled until the provider's analysis showed whether data had been taken.

• Then: Set the doubt point: by default 6 hours before the first deadline

Step

Set the doubt point: by default 6 hours before the first deadline

Six hours is the pack's default. For an incident declared at 09:00 on day 1, the NIS2 doubt point falls at 03:00 on day 2, and the GDPR one at 03:00 on day 4. Put it in the calendars of the person drafting and the person submitting, beside the deadline.

• Then: Brief the signatory and start the draft now

Step

Brief the signatory and start the draft now

Treat a Not settled regime as you would a Reportable one for preparation. Call the person on duty who submits to that authority, so they confirm they can sign in now and not at the deadline. Start the draft from the facts known. Ask Legal now where the test is unclear; their advice is never waited for past the doubt point.

• Then: At the revisit time, is the missing fact now known?

Decision

At the revisit time, is the missing fact now known?

Revisit at the time you set, at every incident update, and at once when a fact changes. Record the result each time, even when nothing has changed. The old decision line stays and the new one says which it replaces, so the log shows what was known when.

• Yes: Does the fact meet the test?
• No: Has the doubt point been reached?

Decision

Does the fact meet the test?

Apply the regime's test to the fact as now known, and record the outcome with the fact that settled it.

• Yes: Reportable: report by the deadline
• No: Not reportable: record why, and revisit at each update

Outcome

Reportable: report by the deadline

Where the incident became reportable because of a later fact, that regime's clocks start when the record shows the fact was known, and the decision is made at once. The executive incident lead decides; the report goes on the facts known.

Outcome

Not reportable: record why, and revisit at each update

Name the indicator, threshold or factor and the fact that failed it. For the GDPR, a breach unlikely to result in a risk is still recorded in the breach record. The decision is revisited at every update until the incident closes.

Decision

Has the doubt point been reached?

Before the doubt point, keep working on the missing fact and set the next revisit time. Once it is reached, the decision is no longer yours to hold open: an unsettled regime is treated as Reportable.

• No: set the next revisit: Record Not settled: the missing fact, who finds it, when to revisit (back to an earlier step)
• Yes: Treat it as Reportable, on the facts known

Step

Treat it as Reportable, on the facts known

Say in the report what is known, what is not, and that the assessment is continuing. Legal reviews within 60 minutes of receiving the draft, the pack's default; with no review by then, the report goes on its approver's decision. NIS2 says the mere act of notification does not expose the entity to increased liability.

• Then: Can the report still go before its deadline?

Decision

Can the report still go before its deadline?

The doubt point leaves 6 hours, by the pack's default, so the answer is normally yes. It may not be if the doubt point was missed or a channel is down. Never hold a report back because its deadline has passed.

• Yes: Report by the deadline, saying the assessment continues
• No: Report as soon as possible, with the reasons for the delay

Outcome

Report by the deadline, saying the assessment continues

Later reports update it. If the facts later show the test was never met, update or withdraw it with an explanation. Under DORA that is a reclassification notified on the template; never stop reporting silently.

Outcome

Report as soon as possible, with the reasons for the delay

Tell the executive incident lead at once. Under NIS2, tell the CSIRT by telephone or email if the portal is the cause. Under the GDPR, a notification after 72 hours is still made, with the reasons. Under DORA, tell the authority before the limit passes and say why. The late report goes to the post-incident review.