Regulatory Incident Notification Pack — Guide

Regulatory Incident Notification & Reporting

One incident can start three legal clocks at once. A ransomware attack on a NIS2 entity that also holds customer data may need an early warning to the national cyber security team within 24 hours, a notification to the data protection authority within 72 hours, and more reports after that. If the organisation is a bank or an insurer, DORA adds its own reports. Each regime has its own test, its own recipient and its own content. This pack makes the decisions quickly, records them, and gets every report in on time.

Is this for you?

This pack is for you if:

• nobody is sure who decides whether an incident must be reported, or who presses “submit”;
• only one person can log in to the authority’s portal;
• your incident plan says “notify the regulator if required” and stops there;
• you have decided not to report an incident and could not now show why.

How it fits with incident management

The incident management pack runs the response. It owns the reporting duties and their clocks, and it screens every incident against them within four hours of declaring it. This pack takes over from that screen. It says how each legal test is applied and recorded, what each report must contain, who drafts, checks, approves and submits it, and how the next deadline is kept.

Every clock that runs from awareness starts when the incident is declared. None of them waits for the decision.

Deciding under doubt

Most hard calls are made with half the facts. The decision model records one of four answers for each regime: Reportable, Not reportable, Not applicable or Not settled. A Not settled answer carries the time it will be looked at again. If it is still not settled six hours before the first deadline, the report goes in on the facts known and says that the assessment continues. A report can be updated or withdrawn. A missed deadline cannot be undone.

How it runs in practice

Take a distributor with 900 staff, three warehouses and an online ordering service. It is an important entity under NIS2, a controller of its customers’ data, and not a financial entity, so DORA does not apply.

On 12 August 2026 ransomware encrypted 14 office PCs at one warehouse. The incident was declared at 08:25. The screen at 11:30 found it significant under NIS2, because the malware was spreading towards the systems that run dispatch. Whether customer data had been taken was not yet known, so the GDPR answer was Not settled. The early warning went at 15:40, seven hours after declaration. On 14 August the investigation found nothing taken and every file restored from backup, so the breach was recorded and not notified. The incident notification went that afternoon, and the final report on 11 September, three days inside its deadline.

On 9 September a customer service agent emailed 212 customers’ names, addresses and order histories to the wrong business customer. The recipient confirmed deletion the same day. The Data Protection Officer judged it a risk, but not a high risk, so the supervisory authority was notified within 47 hours and the customers were not told.

The other three incidents of the quarter were screened, found not reportable, and recorded with their reasons.

The first readiness check, on 18 September, found that the deputy for the NIS2 portal had no account. Had the incident manager been unavailable on 12 August, nobody could have sent the early warning. The account was issued and tested within a week.

Start with these three

1. Reportability Decision Model: the three tests, step by step, and how to record a decision you can defend.
2. Regulatory Notification Operating Procedure: the eighteen rules and who does what, from screen to final report.
3. Notification Readiness Checklist: what must be in place before the next incident.

Your first month

What to report

Every quarter, with the incident measures, report to executive management:

• decisions recorded within four hours of declaration, for every regime;
• reports made on time, out of all that fell due;
• follow-up reports overdue;
• readiness checks Ready, and any blocking check that is not.

Everything in the pack

Adapting it

• National law: NIS2 is a directive, and each Member State’s law names the authority, the portal and sometimes a shorter clock. Enter them in the applicability profile and confirm them with counsel.
• Financial entity: DORA’s reports use the European template through your competent authority’s channel. The matrix and the decision model cover them; this pack has no DORA form of its own.
• Processor of others’ data: tell each controller within 24 hours, or sooner if the contract says so. The controller decides and notifies.
• Supplier incident: a supplier’s notice under the third-party security pack contract clause is screened as your own incident, with its own awareness time.

Framework references

• ISO/IEC 27001:2022: Annex A 5.5, A 5.26.
• NIST CSF 2.0: RS.CO-02.
• NIS2: Article 23.
• DORA: Article 19.
• GDPR: Articles 33 and 34.