Who approves and submits a regulatory notification, including out of hours?

Start

An incident may need a report to an authority

Reporting clocks run on calendar hours, through nights, weekends and public holidays. A report can fall due at 03:00 on a Sunday. So every role in this flow has a named deputy, and the people, access and templates are set up before the incident. The incident manager runs P09's reporting screen within 4 hours of declaration.

• Then: The executive incident lead decides whether to report

Step

The executive incident lead decides whether to report

Every decision to report is the executive incident lead's, taken on the incident manager's screen, with the Data Protection Officer advising on every GDPR decision. A decision not to report a Severity 1 or 2 incident is the executive incident lead's too. Only for Severity 3 and 4 may the incident manager record a decision not to report. Out of hours, the named deputy holds the same authority.

• Then: Is any regime Reportable, or not yet settled?

Decision

Is any regime Reportable, or not yet settled?

Each regime in the profile gets its own recorded decision: Reportable, Not reportable, Not applicable or Not settled. A decision that is not settled still starts the work, because it becomes Reportable 6 hours before the first deadline, the pack's default, if the facts stay unknown. If you are unsure, treat it as yes.

• Yes, or not known: Call the signatory on duty now
• No: Record the decision and its reasons; revisit it at each update

Outcome

Record the decision and its reasons; revisit it at each update

A decision not to report is recorded in the log with the facts relied on and who decided, whether or not a report is made. It is revisited at each incident update and at once when a fact changes. If a regime becomes Reportable later, come back into this flow at the briefing step.

Step

Call the signatory on duty now

The incident manager calls the notification signatory for each regime that is Reportable or not settled. Out of hours a message alone is not enough. Say which reports are coming, to which authority and when each is due, from the log. The signatory checks at once that they can sign in to the channel; if they cannot, the deputy takes over now, not at the deadline.

• Then: The incident manager or the DPO drafts from the fact base

Step

The incident manager or the DPO drafts from the fact base

The drafter depends on the regime: the incident manager drafts the NIS2 and DORA reports, the Data Protection Officer the GDPR notification and any communication to individuals. Every fact comes from the one fact base, so reports to different authorities agree. Say what is not yet known and when it will follow. Send the draft to Legal and the approver at the same time, with the deadline at the top.

• Then: Legal reviews within 60 minutes, or the approver decides

Step

Legal reviews within 60 minutes, or the approver decides

Legal checks the draft against the fact base and for anything that says more than it needs. The review is time-boxed, at 60 minutes in the pack's default, counted from when the draft was sent, by night as by day. Legal never holds a report. If no review has come back by then, the report goes on its approver's decision and the log records that the review lapsed.

• Then: Can the report's approver be reached?

Decision

Can the report's approver be reached?

The approver is the one P09 names for the report's template, and nobody else may approve a report. In the pack that is the executive incident lead for the NIS2 and DORA reports, and the executive incident lead with the Data Protection Officer for the GDPR notification. A processor's notice to a controller is approved by the executive incident lead, as a customer notice. If they cannot be reached in time, answer no.

• Yes: The approver approves it in writing, with the time
• No, or not known: Their named deputy approves instead

Step

The approver approves it in writing, with the time

Approval is in writing with its time: an email or a message in the case channel. Out of hours, approval by phone is written into the log by the incident manager with the time, and the approver confirms it in writing afterwards.

• Then: Are at least 60 minutes left before the deadline?

Step

Their named deputy approves instead

An approver who cannot be reached is replaced by their named deputy, who holds the same authority while acting. The approver is told as soon as they are reached. This works only if each approver's deputy was named and reachable out of hours before the incident.

• Then: Are at least 60 minutes left before the deadline?

Decision

Are at least 60 minutes left before the deadline?

When time allows, a second person compares the approved report with the fact base line by line before it goes: times, numbers, names, systems and the authority's earlier reference. The threshold is 60 minutes in the pack's default. With less time, the report goes unchecked rather than late.

• Yes: A second person checks it against the fact base
• No: log why the check was skipped: Can the signatory on duty sign in to the channel?

Step

A second person checks it against the fact base

The drafter cannot be the second person. In a small organisation, name a second person for this check before any incident, even if it is someone outside security.

• Then: Can the signatory on duty sign in to the channel?

Decision

Can the signatory on duty sign in to the channel?

Only a notification signatory submits: a person named in writing in advance, with the authority to submit in the organisation's name and working access to the authority's channel. The signatory can be the drafter. If the signatory cannot sign in, or cannot be reached, answer no.

• Yes: Submit, log it and set the next due time
• No, or not known: Hand over to the deputy signatory, or the fallback route

Step

Hand over to the deputy signatory, or the fallback route

The deputy signatory submits, and the Head of Information Security is told. If no signatory can reach the channel, or the channel itself is down, use the authority's fallback route recorded in the applicability profile, log it, and resubmit through the channel if the authority asks.

• Then: Submit, log it and set the next due time

Step

Submit, log it and set the next due time

The signatory submits under their own account, then logs the time, channel, who submitted, a copy of what was sent and the authority's reference. The next report's due time goes into the log and the calendars of its drafter and signatory, with a reminder at half the time remaining. A report that will be late is still made, with the reasons, and the executive incident lead is told at once.

• Then: Is another report due, or has the authority asked for one?

Decision

Is another report due, or has the authority asked for one?

NIS2 and DORA reports come in stages: after NIS2's early warning come the incident notification and the final report. A request from the authority for an intermediate report is a new due time at once. Each follow-up is drafted, reviewed, approved, checked, submitted and logged exactly as the first.

• Yes: draft the next one: The incident manager or the DPO drafts from the fact base (back to an earlier step)
• No: Mark the reports complete; give the history to the review

Outcome

Mark the reports complete; give the history to the review

When every Reportable regime has its last report made, every request answered and every correction made, the incident manager marks the incident's reports complete in the log. The report history, with any late or skipped step and why, goes to the post-incident review.