Guidance · Situation

We may have to tell a regulator

An incident is open and a reporting clock may be running.

Why this moment is hard

The deadline can start before you know what happened. Several regimes may apply at once, each with its own clock, its own authority and its own idea of serious. Waiting for certainty is itself a decision.

5 Guidance questions3 pack documentsAbout 3 h 10 min of reading in all

This is a reading path, not a checklist. Nothing is ticked off or saved, and you can start at any step.

First, the decisions

Guidance · Incidents and regulatory notification
If we can't tell whether an incident is reportable and the deadline is close, then what?
5 decision points · about 10 min to read
Why here If you cannot tell yet and the deadline is close, start here.
Guidance · Incidents and regulatory notification
When do we have to notify a regulator, and under which regime?
8 decision points · about 15 min to read
Why here Which regimes apply, and when each one requires notice.
Guidance · Incidents and regulatory notification
How do we decide whether an incident is significant under NIS2?
9 decision points · about 10 min to read
Why here The NIS2 test for a significant incident.
Guidance · Incidents and regulatory notification
When one incident triggers NIS2, DORA and GDPR at once, which clock runs first?
4 decision points · about 10 min to read
Why here When NIS2, DORA and the GDPR are all triggered, which clock runs first.
Guidance · Incidents and regulatory notification
Who approves and submits a regulatory notification, including out of hours?
5 decision points · about 10 min to read
Why here Who approves and submits the notice, including out of hours.

Then, the documents

Framework / Methodology · P18-A03
Reportability Decision Model
Regulatory Incident Notification & Reporting · about 50 min to read
Why here Record the reportability decision and the reasoning behind it.
Matrix / Catalogue · P18-A02
EU Incident Notification Timeline Matrix (NIS2, DORA, GDPR)
Regulatory Incident Notification & Reporting · about 45 min to read
Why here Who must be told, by when and with what, regime by regime.
Template / Form · P18-A05
NIS2 Early Warning, Notification & Final Report Templates
Regulatory Incident Notification & Reporting · about 40 min to read
Why here Drafting templates for each NIS2 reporting stage.

There is no CISO Times tool for this situation yet, so the path ends with the documents.

Reading times are estimates: the words on each question's flow or document's preview at 220 words a minute, rounded up to the next five minutes. A tool shows its own time.