Regulatory Incident Notification Pack — Guide
- Version 1.3
- Updated
- 9 documents
- Excel, Word
Regulatory Incident Notification & Reporting
One incident can start three legal clocks at once. A ransomware attack on a NIS2 entity that also holds customer data may need an early warning to the national cyber security team within 24 hours, a notification to the data protection authority without undue delay and, where feasible, within 72 hours, and more reports after that. If the organisation is a bank or an insurer, DORA adds its own reports. Each regime has its own test, its own recipient and its own content. This pack makes the decisions quickly, records them, and gets every report in on time.
Is this for you?
This pack is for you if:
- nobody is sure who decides whether an incident must be reported, or who presses “submit”;
- only one person can log in to the authority’s portal;
- your incident plan says “notify the regulator if required” and stops there;
- you have decided not to report an incident and could not now show why.
How it fits with incident management
The incident management pack runs the response. It owns the reporting duties and their clocks, and it screens every incident against them within four hours of declaring it. This pack takes over from that screen. It says how each legal test is applied and recorded, what each report must contain, who drafts, checks, approves and submits it, and how the next deadline is kept.
| Regime | Who it binds | Test | Reports and clocks |
|---|---|---|---|
| NIS2 | Essential and important entities | A significant incident: severe disruption or loss to us, or considerable damage to others, done or possible | Early warning within 24 hours of awareness; incident notification within 72 hours; final report within one month of the notification |
| DORA | Financial entities | A major ICT-related incident: critical services affected, and a malicious intrusion or two materiality thresholds met | Initial notification within 4 hours of classifying it as major and no later than 24 hours after awareness; intermediate report within 72 hours; final report within one month of the latest intermediate report |
| GDPR | Controllers of personal data | A personal data breach that is a risk to people | The supervisory authority without undue delay and, where feasible, within 72 hours of awareness; the people affected without undue delay where the risk is high |
Every clock that runs from awareness starts when the incident is declared, or earlier where the record shows reasonable certainty. That is the pack’s own conservative choice: the law lets an entity make a short initial assessment before it counts as aware, and the pack does not use that allowance. None of the clocks waits for the decision.
If you are in the United States
The pack has a second set of documents for the US duties: HIPAA’s breach notices, the SEC’s Form 8-K Item 1.05, New York’s financial services rule, State breach laws and the FTC’s rules. They do not start at awareness. HIPAA, State laws and the FTC count from discovery, the first day anyone knew, which can be a day before the incident is declared. The SEC’s four business days count from the decision that the incident is material. New York’s 72 hours count from determining that a cybersecurity incident has occurred, and an extortion payment starts two more clocks. The US timeline matrix gives each clock and a calculator, and the US templates the content of each notice. State laws are placeholders, with California and New York as examples. None of this is legal advice, and no notice stands in for another.
Deciding under doubt
Most hard calls are made with half the facts. The decision model records one of four answers for each regime: Reportable, Not reportable, Not applicable or Not settled. A Not settled answer carries the time it will be looked at again. If it is still not settled six hours before the first deadline, the report goes in on the facts known and says that the assessment continues. A report can be updated or withdrawn. A missed deadline cannot be undone.
How it runs in practice
Take a distributor with 900 staff, three warehouses and an online ordering service. It is an important entity under NIS2, a controller of its customers’ data, and not a financial entity, so DORA does not apply.
On 12 August 2026 ransomware encrypted 14 office PCs at one warehouse. The incident was declared at 08:25. The screen at 11:30 found it significant under NIS2, because the malware was spreading towards the systems that run dispatch. Whether customer data had been taken was not yet known, so the GDPR answer was Not settled. The early warning went at 15:40, seven hours after declaration. On 14 August the investigation found nothing taken and every file restored from backup, so the breach was recorded and not notified. The incident notification went that afternoon, and the final report on 11 September, three days inside its deadline.
On 9 September a customer service agent emailed 212 customers’ names, addresses and order histories to the wrong business customer. The recipient confirmed deletion the same day. The Data Protection Officer judged it a risk, but not a high risk, so the supervisory authority was notified within 47 hours and the customers were not told.
The other three incidents of the quarter were screened, found not reportable, and recorded with their reasons.
The first readiness check, on 18 September, found that the deputy for the NIS2 portal had no account. Had the incident manager been unavailable on 12 August, nobody could have sent the early warning. The account was issued and tested within a week.
Start with these three
- Reportability Decision Model: the three tests, step by step, and how to record a decision you can defend.
- Regulatory Notification Operating Procedure: the rules and who does what, from screen to final report.
- Notification Readiness Checklist: what must be in place before the next incident.
Your first month
| When | What to do | You’re done when |
|---|---|---|
| Week 1 | Write the applicability profile: which regimes apply, in which role, and which authority receives each report. | Executive management has approved it. |
| Week 2 | Name a signatory and a deputy for each authority’s channel, and test that both can sign in. | Every channel has two people with working access. |
| Week 3 | Fill in the templates with your organisation’s details, and agree a one-hour review limit with Legal. | A report could be drafted without looking anything up. |
| Week 4 | Run the readiness checklist, and rehearse one early warning in your next exercise. | No blocking check is Not ready. |
What to report
Every quarter, with the incident measures, report to executive management:
- decisions recorded within four hours of declaration, for every regime;
- reports made on time, out of all that fell due;
- follow-up reports overdue;
- readiness checks Ready, and any blocking check that is not.
Everything in the pack
- Excel
EU Incident Notification Timeline Matrix (NIS2, DORA, GDPR)
Every report: trigger, clock, recipient, content and who does it, with a deadline calculator
- Word
Reportability Decision Model
The NIS2, DORA and GDPR tests, and how each decision is recorded
- Word
Regulatory Notification Operating Procedure
Decision authority, drafting, review, submission and follow-up
- Word
NIS2 Early Warning, Notification & Final Report Templates
The content of each NIS2 report, with field guidance
- Word
Personal Data Breach Notification Templates
Notification to the authority, and communication to the people affected
- Excel
Regulatory Notification Log
Every decision and submission, with due times and references
- Excel
Notification Readiness Checklist
Portals, contacts, signatories and templates, checked before an incident
- Excel
US Incident Notification Timeline Matrix (HIPAA, SEC, NYDFS and State Law)
Every US duty: trigger, clock, recipient, content and who does it, with a deadline calculator
- Word
US Notification Templates (HIPAA, SEC Form 8-K, NYDFS, State Attorney General)
The content of each US notice, with field guidance
No document matches those words.
Adapting it
- National law: NIS2 is a directive, and each Member State’s law names the authority, the portal and sometimes a shorter clock. Enter them in the applicability profile and confirm them with counsel.
- Not covered here: CIRCIA (its final rule had not been published on 18 October 2026), DFARS and foreign private issuers (who report on Form 6-K) are named in the incident management pack and not worked through. Industry groups have asked the SEC to rescind Form 8-K Item 1.05; no SEC proposal had been found on 18 October 2026, so check sec.gov for its status.
- Financial entity: DORA’s reports use the European template through your competent authority’s channel. The matrix and the decision model cover them; this pack has no DORA form of its own.
- Processor of others’ data: tell each controller within 24 hours, or sooner if the contract says so. The controller decides and notifies.
- Supplier incident: a supplier’s notice under the third-party security pack contract clause is screened as your own incident, with its own awareness time.
Framework references
- ISO/IEC 27001:2022: Annex A 5.5, A 5.26.
- NIST CSF 2.0: RS.CO-02.
- NIS2: Article 23.
- DORA: Article 19.
- GDPR: Articles 33 and 34.
- Cyber Resilience Act: Article 14, for manufacturers of products with digital elements (applies from 11 September 2026).
- HIPAA: 45 CFR 164.402 to 164.412.
- SEC: Form 8-K Item 1.05.
- NYDFS: 23 NYCRR 500.17.