EU Incident Notification Timeline Matrix (NIS2, DORA, GDPR)
Sets out who must be notified, by when, with what content and on what trigger under each regime.
Available soon
- Format
- Excel
- Size
- 85 KB
- Length
- 12 sheets
- Version
- 1.1
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.1
Quotes P09's corrected RD-10 deadline.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Read the Timeline Matrix first. Each row is one reporting duty from P09's Incident Classification, Severity & Escalation Matrix. The duties and their deadlines are P09's: this workbook adds what opens each one, where its clock starts, where the report goes, what it contains and who sends it. Two rows marked "Not a P09 duty" cover NIS2's trust service providers and DORA's voluntary notice of a significant cyber threat. |
| 2 | Tailor it once, from your applicability profile (RN-01). Replace the [[placeholders]] in the Recipient and Channel columns with your authorities and their portals. If national law sets a shorter clock, enter it in the hours column (CN-08): the calculator reads it from there. Do not change a clock for any other reason. |
| 3 | When an incident is declared, P09's screen decides within 4 hours which regimes apply (P09 IM-06), using the Reportability Decision Model. For each regime decided Reportable, read its rows across: what opens each report, when it is due, where it goes and who sends it. |
| 4 | On the Clock Calculator sheet, enter the incident, the time of awareness and the three answers. For DORA, enter the time the incident was classified as major. Each due time calculates. As each report is made, enter its time: the next report's due time follows (RN-10). Copy every due time into the Regulatory Notification Log and the calendars of the drafter and the signatory. |
| 5 | Draft every report from one fact base (RN-11). The Report Content sheet lists what each report must contain and which fact base fields supply it. Use the NIS2 Early Warning, Notification & Final Report Templates and the Personal Data Breach Notification Templates for the wording. |
| 6 | The Clock Rules sheet explains how each clock is counted (CN-01 to CN-12). Set its three settings: the doubt point, whether you may use DORA's weekend rule for the first two reports, and your bank holidays. |
| 7 | Review the matrix with the applicability profile, at least once a year, and whenever P09's duties, an authority or a channel change. Delete the EXAMPLE and TEST rows on the Clock Calculator sheet before approval. The Timeline Matrix, Report Content and Clock Rules sheets are the content itself: tailor them, do not delete them. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
This document helps you apply the tests in NIS2, DORA and the GDPR to your own facts. It is not legal advice. National law may add to the Directive, and authorities publish their own guidance, forms and portals, so confirm your approach with counsel before you rely on it.
National law: [[national law transposing NIS2: title, number and date]]. Where it adds a report or shortens a clock, enter it in the matrix and in the applicability profile (CN-08, RN-01). [[any duty or field the national law adds to the Directive]].
One incident can open several regimes at once. Each regime's clock runs on its own; none waits for another. The reports must still agree with each other, so all are drafted from the one fact base (RN-11).
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders; an important entity under NIS2 in its Member State; not a financial entity, so DORA's reporting duties do not apply. The EXAMPLE sheet shows its applicability profile and its ransomware incident of 12 Aug 2026, which ran NIS2's three clocks and, for two days, a possible GDPR clock. TEST rows on the Clock Calculator sheet show DORA's clocks for readers it applies to; they are test inputs, not a worked example.
Tailoring — small organisation: one person may draft and another approve every report, but name a deputy for each and for every signatory (RN-08). Keep every row: a regime that cannot apply to you is marked Not applicable in the profile, with the reason.
Tailoring — financial entity: where DORA applies to you, use RD-10 to RD-13 for ICT-related incidents. If you are also an essential or important entity under NIS2, DORA's reporting takes the place of NIS2's (NIS2 Article 4(1), DORA Article 1(2)), and DORA's weekend rule never applies to your first two reports (CN-09). The GDPR still applies alongside.
Tailoring — processor of personal data for others: RD-09 is your duty, within the time RN-15 and each contract set. The controller decides whether to notify. A controller not established in the EU notifies every supervisory authority where affected people live (EDPB Guidelines 9/2022, paragraph 73).
Tailoring — IT run by a service provider: the provider may detect the incident, but awareness, every decision and every report stay yours. Agree in the contract how fast it tells you (P06 CL-07), because your clocks may already be running.
Timeline Matrix
One row per P09 reporting duty, plus two rows that are not P09 duties. The deadlines are P09's (RD-01 to RD-16). Yellow cells are yours to tailor from your applicability profile (RN-01).
This document helps you apply the tests in NIS2, DORA and the GDPR to your own facts. It is not legal advice. National law may add to the Directive, and authorities publish their own guidance, forms and portals, so confirm your approach with counsel before you rely on it.
| Duty ID | Regime | Report | Whose duty | Applies to | What opens it | Clock starts at | Deadline (P09's words) | Clock (hours) | DORA: hours after classifying as major | Clock (months, due at the end of the day) | Recipient | Channel | What it contains (see Report Content) | Template or form | Drafts | Approves | Submits | Reference |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RD-01 | NIS2 | Early warning | P09's duty | Essential and important entities, for a significant incident | NIS2 decision Reportable: a significant incident. Any one indicator NS-01 to NS-06 met, on what the incident has done or could do. | Awareness (CN-01), or when a later fact made it reportable (CN-02) | Within 24 hours of awareness | 24 | — | — | [[national CSIRT, or the competent authority where notifications go to it]] | [[the national notification portal or address, from the national law or the CSIRT's website]] | 5 items (RD-01.1 to RD-01.5): who we are and a contact; what happened and when we knew; suspected unlawful or malicious cause; possible cross-border impact; help wanted from the CSIRT | NIS2 Early Warning, Notification & Final Report Templates (A05), early warning; P09 CT-06 NIS2 early warning and notification content | Incident manager | Executive incident lead | Notification signatory | NIS2 Article 23(4)(a) |
| RD-02 | NIS2 | Incident notification | P09's duty | Essential and important entities, for a significant incident | The same NIS2 decision as RD-01. Due whether or not anything has changed since the early warning. | Awareness (CN-01), or when a later fact made it reportable (CN-02) | Within 72 hours of awareness | 72 | — | — | [[national CSIRT, or the competent authority where notifications go to it]] | [[the national notification portal or address, from the national law or the CSIRT's website]] | 4 items (RD-02.1 to RD-02.4): the early warning's reference and changes; initial assessment of severity and impact; indicators of compromise; measures taken, recipients told | NIS2 Early Warning, Notification & Final Report Templates (A05), incident notification; P09 CT-06 NIS2 early warning and notification content | Incident manager | Executive incident lead | Notification signatory | NIS2 Article 23(4)(b) |
| — | NIS2 | Incident notification: trust service provider | Not a P09 duty. A variant of RD-02 for trust service providers (CN-12). | Trust service providers, for a significant incident affecting their trust services | The NIS2 decision Reportable, for an incident with an impact on the provision of trust services. | Awareness (CN-01) | Within 24 hours of awareness, in place of RD-02's clock | 24 | — | — | [[national CSIRT, or the competent authority where notifications go to it]] | [[the national notification portal or address, from the national law or the CSIRT's website]] | As RD-02 | NIS2 Early Warning, Notification & Final Report Templates (A05), incident notification | Incident manager | Executive incident lead | Notification signatory | NIS2 Article 23(4), second subparagraph |
| RD-03 | NIS2 | Intermediate report | P09's duty | Essential and important entities, for a significant incident | The same NIS2 decision, and a request from the CSIRT or competent authority for a status update. | The authority's request | When the authority asks | — | — | — | [[national CSIRT, or the competent authority where notifications go to it]] | [[the national notification portal or address, from the national law or the CSIRT's website]] | 1 item (RD-03.1): the status updates asked for | NIS2 Early Warning, Notification & Final Report Templates (A05), or the authority's own request form | Incident manager | Executive incident lead | Notification signatory | NIS2 Article 23(4)(c) |
| RD-04 | NIS2 | Final report | P09's duty | Essential and important entities, for a significant incident | The same NIS2 decision. If the incident is still being handled at this deadline, a progress report goes instead and the final report follows (CN-03). | The incident notification, RD-02 (CN-03) | Within one month of the incident notification (a progress report then, and the final report within one month of handling, if still ongoing) | — | — | 1 | [[national CSIRT, or the competent authority where notifications go to it]] | [[the national notification portal or address, from the national law or the CSIRT's website]] | 4 items (RD-04.1 to RD-04.4): detailed description, severity and impact; threat type or root cause; mitigation applied and under way; cross-border impact | NIS2 Early Warning, Notification & Final Report Templates (A05), final report or progress report | Incident manager | Executive incident lead | Notification signatory | NIS2 Article 23(4)(d); NIS2 Article 23(4)(e) |
| RD-05 | NIS2 | Notice to recipients of our services | P09's duty | Essential and important entities, for a significant incident | The same NIS2 decision, where a recipient's service is likely to be adversely affected. For a significant cyber threat, recipients are told what they can do. | Awareness | Without undue delay, where appropriate | — | — | — | Customers whose service is likely to be adversely affected | Email, letter, website or account message, as the template and the people affected allow | 2 items (RD-05.1 to RD-05.2): the likely effect on their service; measures they can take against a threat | P09 CT-04 Customer notice | Communications lead | Executive incident lead (P09 CT-04) | Communications lead (RN-14) | NIS2 Article 23(1); NIS2 Article 23(2) |
| RD-06 | GDPR | Notification to the supervisory authority | P09's duty | Controllers, unless the breach is unlikely to result in a risk to individuals | GDPR decision Reportable: a personal data breach assessed as Risk or High risk, where we are the controller. | Awareness of the personal data breach (CN-01, CN-06) | Without undue delay and, where feasible, within 72 hours of awareness; later only with reasons for the delay | 72 | — | — | [[lead supervisory authority, or the supervisory authority of the Member State concerned]] | [[the authority's breach notification form or portal]] | 6 items (RD-06.1 to RD-06.6): nature of the breach, people and records; contact point; likely consequences; measures taken or proposed; reasons for any delay; what follows later | Personal Data Breach Notification Templates (A06), or the authority's own form; P09 CT-07 GDPR notification to the supervisory authority | Data Protection Officer | Executive incident lead, with the Data Protection Officer | Notification signatory | GDPR Article 33(1); GDPR Article 33(4); GDPR Article 56(1) |
| RD-07 | GDPR | Communication to the individuals affected | P09's duty | Controllers, where the breach is likely to result in a high risk to individuals, unless an Article 34(3) condition is met | A personal data breach assessed as High risk, unless an Article 34(3) condition is met. | Awareness of the personal data breach | Without undue delay | — | — | — | The data subjects | Email, letter, website or account message, as the template and the people affected allow | 4 items (RD-07.1 to RD-07.4): what happened, in plain language; contact point; likely consequences; what we did and what they can do | Personal Data Breach Notification Templates (A06); P09 CT-08 Communication to individuals affected | Communications lead | Executive incident lead, with the Data Protection Officer (P09 CT-08) | Communications lead (RN-14) | GDPR Article 34(1) |
| RD-08 | GDPR | Breach record | P09's duty | Controllers | Every personal data breach, whatever the risk level (Unlikely to result in a risk, Risk, High risk). It is a record, not a report. | No clock | For every personal data breach, notified or not | — | — | — | Kept by us; shown to the authority on request | Kept in the log (A07) | 2 items (RD-08.1 to RD-08.2): facts, effects and remedial action; the risk decision and its reasons | Regulatory Notification Log (A07): the decision record, with P09's case log | Data Protection Officer | Executive incident lead records the decision (RN-06) | Not submitted; shown to the authority on request | GDPR Article 33(5) |
| RD-09 | GDPR | Notice to the controller | P09's duty | Where we act as a processor | A personal data breach in data we process for another controller. We tell the controller; the controller decides (RN-15). | Our awareness, as processor | Without undue delay | — | — | — | The controller whose data we process | [[the controller's breach contact, from the processing contract]] | 1 item (RD-09.1): everything the controller needs to notify | The controller's form where the contract gives one; otherwise the content of the Personal Data Breach Notification Templates (A06) as a checklist | Data Protection Officer | Executive incident lead | Data Protection Officer, to the controller's breach contact (RN-15) | GDPR Article 33(2) |
| RD-10 | DORA | Initial notification | P09's duty | Financial entities, for a major ICT-related incident | DORA decision Reportable: a major ICT-related incident. Critical services affected, and either a malicious unauthorised access or two other thresholds met. | Classification as major, and awareness: the earlier limit wins (CN-04, CN-10) | Within 4 hours of classifying the incident as major, and no later than 24 hours after awareness; where it is classified as major only after those 24 hours, within 4 hours of that classification | 24 | 4 | — | [[financial competent authority designated under DORA Article 46]] | [[the authority's reporting channel for the Implementing Regulation (EU) 2025/302 template]] | 5 items (RD-10.1 to RD-10.5): who we are; detection and classification times; description and how it was found; criteria met; Member States affected, continuity plan | The Annex I template of Implementing Regulation (EU) 2025/302, initial notification | Incident manager | Executive incident lead | Notification signatory, or the third party under RN-16 | DORA Article 19(4); Delegated Regulation (EU) 2025/301 Article 5; Delegated Regulation (EU) 2025/301 Article 5(2) |
| RD-11 | DORA | Intermediate report | P09's duty | Financial entities, for a major ICT-related incident | The same DORA decision, once the initial notification is made. Again when regular activities are recovered. | The initial notification, RD-10 | Within 72 hours of the initial notification, and again when regular activities are recovered | 72 | — | — | [[financial competent authority designated under DORA Article 46]] | [[the authority's reporting channel for the Implementing Regulation (EU) 2025/302 template]] | 4 items (RD-11.1 to RD-11.4): reference and updates; clients, counterparts, transactions, downtime; incident type, techniques, systems; recovery actions and times | The Annex I template of Implementing Regulation (EU) 2025/302, intermediate report | Incident manager | Executive incident lead | Notification signatory, or the third party under RN-16 | DORA Article 19(4); Delegated Regulation (EU) 2025/301 Article 5 |
| RD-12 | DORA | Final report | P09's duty | Financial entities, for a major ICT-related incident | The same DORA decision, once the latest intermediate report is made. | The latest intermediate report, RD-11 (CN-05) | No later than one month after the latest intermediate report | — | — | 1 | [[financial competent authority designated under DORA Article 46]] | [[the authority's reporting channel for the Implementing Regulation (EU) 2025/302 template]] | 3 items (RD-12.1 to RD-12.3): root cause and fix; actual impact, final figures; recurrence and lessons | The Annex I template of Implementing Regulation (EU) 2025/302, final report | Incident manager | Executive incident lead | Notification signatory, or the third party under RN-16 | DORA Article 19(4); Delegated Regulation (EU) 2025/301 Article 5 |
| RD-13 | DORA | Notice to clients | P09's duty | Financial entities, for a major ICT-related incident | The same DORA decision, where the incident affects clients' financial interests. | Awareness | Without undue delay | — | — | — | Clients whose financial interests are affected | Email, letter, website or account message, as the template and the people affected allow | 1 item (RD-13.1): the effect on their financial interests and the measures taken | P09 CT-04 Customer notice | Communications lead | Executive incident lead (P09 CT-04) | Communications lead (RN-14) | DORA Article 19(3) |
| — | DORA | Voluntary notification of a significant cyber threat | Not a P09 duty. Voluntary: the financial entity decides whether to send it. | Financial entities, where they judge a significant cyber threat relevant to the financial system, service users or clients | A significant cyber threat: a threat that could cause a significant or major incident but has not yet done so. NIS2 asks us to tell affected recipients what they can do about it; DORA lets financial entities notify one voluntarily. | No clock | Voluntary; no deadline | — | — | — | [[financial competent authority designated under DORA Article 46]] | [[the authority's reporting channel for the Implementing Regulation (EU) 2025/302 template]] | General information; when it was detected; a description; its potential impact; the classification criteria that would have been met; its status; preventive actions; notifications to others; indicators of compromise | The Annex III template of Implementing Regulation (EU) 2025/302 | Incident manager | Executive incident lead | Notification signatory, or the third party under RN-16 | DORA Article 19(2); Delegated Regulation (EU) 2025/301 Article 6; Implementing Regulation (EU) 2025/302 Article 8 |
| RD-14 | Contract | Notice to customers under contract | P09's duty | Where a contract requires it | P09's screen finds a contract with a notification clause that the incident touches. | Awareness, or as the contract says | [[as each contract requires]] | — | — | — | [[customers with a notification clause]] | [[as P09's contact list gives it]] | What the contract asks for | P09 CT-04 Customer notice, or the form the contract requires | As P09 assigns | Executive incident lead (P09) | As P09 assigns; logged in A07 | No legal clock: the contract, the policy or the reporting service sets it |
| RD-15 | Insurance | Notice to the cyber insurer | P09's duty | Where a cyber policy is held | P09's screen, where a cyber insurance policy is held and its terms require notice. | Awareness, or as the policy says | [[as the policy requires, often within 48 hours]] | — | — | — | [[insurer or broker incident line]] | [[as P09's contact list gives it]] | What the policy asks for | [[the insurer's notification form or incident line]] | As P09 assigns | Executive incident lead (P09) | As P09 assigns; logged in A07 | No legal clock: the contract, the policy or the reporting service sets it |
| RD-16 | Law enforcement | Crime report | P09's duty | Suspected criminal acts, including ransomware and fraud | P09's screen, where a criminal act is suspected. | Awareness of the suspected crime | [[as soon as practical for suspected crime]] | — | — | — | [[national cybercrime reporting service]] | [[as P09's contact list gives it]] | What the reporting service asks for | [[the reporting service's online form]] | As P09 assigns | Executive incident lead (P09) | As P09 assigns; logged in A07 | No legal clock: the contract, the policy or the reporting service sets it |
Rows in italics are not P09 duties. The other notices P09 screens for (RD-14, RD-15, RD-16) have no legal clock: the contract, the policy or the reporting service sets it.
Report Content
What each report must contain, and the fact base fields that supply it (RN-11). The authority's own form, where it has one, is what you fill in.
| Duty ID | Report | Item | What the report must contain | Fact base fields | Reference |
|---|---|---|---|---|---|
| RD-01 | NIS2 early warning | RD-01.1 | Who we are, and a contact who can answer the authority at any hour | FB-01 Entity identification; FB-02 Contact point | NIS2 Article 23(4)(a) |
| RD-01 | NIS2 early warning | RD-01.2 | What has happened, as far as known, and when we became aware | FB-03 What happened; FB-04 Key times | NIS2 Article 23(4)(a) |
| RD-01 | NIS2 early warning | RD-01.3 | Whether the incident is suspected of being caused by unlawful or malicious acts | FB-09 Suspected cause | NIS2 Article 23(4)(a) |
| RD-01 | NIS2 early warning | RD-01.4 | Whether the incident could have a cross-border impact | FB-07 Geography | NIS2 Article 23(4)(a) |
| RD-01 | NIS2 early warning | RD-01.5 | Any help we would like from the CSIRT | Written for this report | NIS2 Article 23(5) |
| RD-02 | NIS2 incident notification | RD-02.1 | The authority's reference for the early warning, and what has changed since | FB-14 Report history | NIS2 Article 23(4)(b) |
| RD-02 | NIS2 incident notification | RD-02.2 | An initial assessment of the incident: its severity and impact | FB-05 Services affected; FB-06 Severity and impact; FB-08 Systems and data affected | NIS2 Article 23(4)(b) |
| RD-02 | NIS2 incident notification | RD-02.3 | Indicators of compromise, where available | FB-11 Indicators of compromise | NIS2 Article 23(4)(b) |
| RD-02 | NIS2 incident notification | RD-02.4 | Measures taken so far, and whether recipients of our services have been told | FB-12 Measures taken; FB-13 Notices to others | NIS2 Article 23(4)(b) |
| RD-03 | NIS2 intermediate report | RD-03.1 | The status updates the authority asked for, quoting its request | FB-14 Report history | NIS2 Article 23(4)(c) |
| RD-04 | NIS2 final report | RD-04.1 | A detailed description of the incident, including its severity and impact | FB-03 What happened; FB-05 Services affected; FB-06 Severity and impact; FB-08 Systems and data affected | NIS2 Article 23(4)(d) |
| RD-04 | NIS2 final report | RD-04.2 | The type of threat or the root cause that is likely to have triggered it | FB-10 Root cause | NIS2 Article 23(4)(d) |
| RD-04 | NIS2 final report | RD-04.3 | The mitigation measures applied and still under way | FB-12 Measures taken | NIS2 Article 23(4)(d) |
| RD-04 | NIS2 final report | RD-04.4 | Where applicable, the cross-border impact | FB-07 Geography | NIS2 Article 23(4)(d) |
| RD-05 | NIS2 notice to recipients of our services | RD-05.1 | That a significant incident is likely to affect the service they receive from us, in plain words | FB-05 Services affected | NIS2 Article 23(1) |
| RD-05 | NIS2 notice to recipients of our services | RD-05.2 | Where the incident is also a significant cyber threat to them: the measures or remedies they can take | FB-13 Notices to others | NIS2 Article 23(2) |
| RD-06 | GDPR notification to the supervisory authority | RD-06.1 | The nature of the breach: categories and approximate number of people concerned, and categories and approximate number of records | FB-03 What happened; FB-15 People affected; FB-16 Personal data affected | GDPR Article 33(3) |
| RD-06 | GDPR notification to the supervisory authority | RD-06.2 | The name and contact details of the Data Protection Officer or other contact point | FB-02 Contact point | GDPR Article 33(3) |
| RD-06 | GDPR notification to the supervisory authority | RD-06.3 | The likely consequences of the breach | FB-17 Likely consequences | GDPR Article 33(3) |
| RD-06 | GDPR notification to the supervisory authority | RD-06.4 | The measures taken or proposed to address the breach, including those to reduce its possible adverse effects | FB-12 Measures taken | GDPR Article 33(3) |
| RD-06 | GDPR notification to the supervisory authority | RD-06.5 | If made after 72 hours, the reasons for the delay | Written for this report | GDPR Article 33(1) |
| RD-06 | GDPR notification to the supervisory authority | RD-06.6 | What is not yet known, and when it will follow (phased notification) | Written for this report | GDPR Article 33(4) |
| RD-07 | GDPR communication to the individuals affected | RD-07.1 | What happened, in clear and plain language | FB-03 What happened | GDPR Article 34(2) |
| RD-07 | GDPR communication to the individuals affected | RD-07.2 | The name and contact details of the Data Protection Officer or other contact point | FB-02 Contact point | GDPR Article 34(2) |
| RD-07 | GDPR communication to the individuals affected | RD-07.3 | The likely consequences for them | FB-17 Likely consequences | GDPR Article 34(2) |
| RD-07 | GDPR communication to the individuals affected | RD-07.4 | What we have done and will do, and what they can do to protect themselves | FB-12 Measures taken; FB-13 Notices to others | GDPR Article 34(2) |
| RD-08 | GDPR breach record | RD-08.1 | The facts of the breach, its effects and the remedial action taken, whether or not it was notified | FB-03 What happened; FB-17 Likely consequences; FB-12 Measures taken | GDPR Article 33(5) |
| RD-08 | GDPR breach record | RD-08.2 | The risk decision and its reasons | Written for this report | GDPR Article 33(5) |
| RD-09 | GDPR notice to the controller | RD-09.1 | Everything the controller needs for its own notification, as far as known: what happened, the data and people concerned, likely consequences, measures taken, and a contact | FB-03 What happened; FB-15 People affected; FB-16 Personal data affected; FB-17 Likely consequences; FB-12 Measures taken; FB-02 Contact point | GDPR Article 28(3)(f) |
| RD-10 | DORA initial notification | RD-10.1 | Who we are: the entity's name, identifier and type, who is submitting, and contacts for the authority | FB-01 Entity identification; FB-02 Contact point | Delegated Regulation (EU) 2025/301 Article 1 |
| RD-10 | DORA initial notification | RD-10.2 | When the incident was detected and when it was classified as major | FB-04 Key times | Delegated Regulation (EU) 2025/301 Article 2 |
| RD-10 | DORA initial notification | RD-10.3 | A description of the incident and how it was discovered | FB-03 What happened | Delegated Regulation (EU) 2025/301 Article 2 |
| RD-10 | DORA initial notification | RD-10.4 | The classification criteria that made it major | FB-18 Classification result | Delegated Regulation (EU) 2025/301 Article 2 |
| RD-10 | DORA initial notification | RD-10.5 | The Member States affected and whether a business continuity plan was activated | FB-07 Geography; FB-12 Measures taken | Delegated Regulation (EU) 2025/301 Article 2 |
| RD-11 | DORA intermediate report | RD-11.1 | The authority's reference, and updates to the initial notification | FB-14 Report history | Delegated Regulation (EU) 2025/301 Article 3 |
| RD-11 | DORA intermediate report | RD-11.2 | Clients, financial counterparts and transactions affected; duration and service downtime | FB-05 Services affected; FB-06 Severity and impact; FB-15 People affected | Delegated Regulation (EU) 2025/301 Article 3 |
| RD-11 | DORA intermediate report | RD-11.3 | The type of incident, the threats and techniques used, and the systems and functions affected | FB-08 Systems and data affected; FB-09 Suspected cause; FB-11 Indicators of compromise | Delegated Regulation (EU) 2025/301 Article 3 |
| RD-11 | DORA intermediate report | RD-11.4 | Actions taken to recover, and when regular activities were or will be recovered | FB-12 Measures taken | Delegated Regulation (EU) 2025/301 Article 3 |
| RD-12 | DORA final report | RD-12.1 | The root cause, and when and how it was addressed | FB-10 Root cause | Delegated Regulation (EU) 2025/301 Article 4 |
| RD-12 | DORA final report | RD-12.2 | The actual impact: final figures for clients, transactions, duration, data and economic impact | FB-05 Services affected; FB-06 Severity and impact; FB-15 People affected; FB-19 Economic impact | Delegated Regulation (EU) 2025/301 Article 4 |
| RD-12 | DORA final report | RD-12.3 | Whether the incident recurred, and the lessons and measures taken | FB-12 Measures taken | Delegated Regulation (EU) 2025/301 Article 4 |
| RD-13 | DORA notice to clients | RD-13.1 | That a major incident has affected their financial interests, and the measures taken to mitigate its adverse effects | FB-05 Services affected; FB-12 Measures taken | DORA Article 19(3) |
| — | DORA voluntary notification of a significant cyber threat | Not a P09 duty | General information; when it was detected; a description; its potential impact; the classification criteria that would have been met; its status; preventive actions; notifications to others; indicators of compromise | FB-01 Entity identification; FB-02 Contact point; FB-04 Key times; FB-03 What happened; FB-05 Services affected; FB-18 Classification result; FB-12 Measures taken; FB-13 Notices to others; FB-11 Indicators of compromise | Delegated Regulation (EU) 2025/301 Article 6 |
The fact base: the one record every report is drafted from (RN-11)
| Field ID | Field | What to record | Content items using it (calc) | Reports using it | |
|---|---|---|---|---|---|
| FB-01 | Entity identification | Legal name, registration or identifier numbers each authority uses, sector and the services in scope. Kept ready in the applicability profile. | 3 | RD-01, RD-10 | |
| FB-02 | Contact point | The person the authority or individuals can reach at any hour: name, role, telephone and email. For the GDPR, the Data Protection Officer. | 6 | RD-01, RD-06, RD-07, RD-09, RD-10 | |
| FB-03 | What happened | A plain description: what was seen, what was affected, what the attacker or fault did, as far as known. | 8 | RD-01, RD-04, RD-06, RD-07, RD-08, RD-09, RD-10 | |
| FB-04 | Key times | Occurrence (if known), detection, declaration (awareness), DORA classification where it applies, containment, recovery. | 3 | RD-01, RD-10 | |
| FB-05 | Services affected | Which services, for whom, how badly and for how long: stopped, degraded, at risk. | 7 | RD-02, RD-04, RD-05, RD-11, RD-12, RD-13 | |
| FB-06 | Severity and impact | P09 severity and the impact on each P05 area; for DORA, the duration and service downtime. | 4 | RD-02, RD-04, RD-11, RD-12 | |
| FB-07 | Geography | Member States where services, customers or data are affected; whether there is or could be a cross-border impact. | 3 | RD-01, RD-04, RD-10 | |
| FB-08 | Systems and data affected | Systems, sites and data sets involved, and the security property affected (availability, integrity, confidentiality, authenticity). | 3 | RD-02, RD-04, RD-11 | |
| FB-09 | Suspected cause | Whether unlawful or malicious acts are suspected, and the type of threat (ransomware, account takeover, fault, supplier failure). | 2 | RD-01, RD-11 | |
| FB-10 | Root cause | The cause established by the investigation, and the route in. Left as "under investigation" until known. | 2 | RD-04, RD-12 | |
| FB-11 | Indicators of compromise | File hashes, addresses, domains, accounts and techniques seen, where they can be shared. | 3 | RD-02, RD-11 | |
| FB-12 | Measures taken | Containment, eradication, recovery and mitigation done and planned, with times; whether continuity plans were activated. | 11 | RD-02, RD-04, RD-06, RD-07, RD-08, RD-09, RD-10, RD-11, RD-12, RD-13 | |
| FB-13 | Notices to others | Customers, clients, individuals and suppliers told, when and how, and what we advised them to do. | 4 | RD-02, RD-05, RD-07 | |
| FB-14 | Report history | Each report made: regime, stage, time, channel and the authority's reference. | 3 | RD-02, RD-03, RD-11 | |
| FB-15 | People affected | Categories and approximate numbers of people (customers, staff, clients) affected. | 4 | RD-06, RD-09, RD-11, RD-12 | |
| FB-16 | Personal data affected | Categories and approximate numbers of personal data records, with any special category or criminal offence data marked. | 2 | RD-06, RD-09 | |
| FB-17 | Likely consequences | What could happen to the people affected (fraud, distress, loss of control of their data, discrimination) and how likely it is. | 4 | RD-06, RD-07, RD-08, RD-09 | |
| FB-18 | Classification result | The DORA criteria and thresholds met, and the NIS2 indicators met, from the decision record. | 2 | RD-10 | |
| FB-19 | Economic impact | Direct and indirect costs and losses, gross and after recoveries, as far as known. | 1 | RD-12 | |
The fact base is kept by the incident manager from the first hour (RN-11). A field not yet known says so, and who is finding it out.
Clock Rules
Clock rules: when each clock starts and how it is counted
How to read the deadlines in the matrix. The deadlines are P09's; these rules say where each clock starts and what moves it.
The clock rules
| Rule | What it says |
|---|---|
| CN-01 | Every clock that runs from awareness starts at the time P09 records it: the declaration, unless the record shows reasonable certainty earlier. It does not wait for the reportability decision. |
| CN-02 | Where an incident becomes reportable later, because a new fact meets a test, that regime's clocks start when the record shows the fact was known (RN-05). The decision is made at once. |
| CN-03 | NIS2's final report runs from the incident notification, not from awareness. If the incident is still being handled at that deadline, a progress report goes instead and the final report follows within one month of handling ending. |
| CN-04 | DORA's initial notification has two limits, and the earlier wins: 4 hours from classifying the incident as major, and 24 hours from awareness. |
| CN-05 | DORA's final report runs from the latest intermediate report, so each update moves it. |
| CN-06 | The GDPR's 72 hours is the outer limit of "without undue delay", not a target. A notification after 72 hours is still made, with the reasons for the delay. |
| CN-07 | Clocks run on calendar hours, through nights, weekends and public holidays. The one exception is DORA's, below (CN-09). |
| CN-08 | National law may shorten a clock or add a report. Where it does, the shorter clock is entered in the applicability profile and used instead (RN-01). |
| CN-09 | DORA: where a deadline falls on a weekend or a bank holiday in the entity's Member State, the report may go by noon of the next working day. This never applies to the initial notification or intermediate report of credit institutions, central counterparties, trading venue operators, or financial entities that are also essential or important entities under NIS2, and the authority may withdraw it from other significant or systemic entities. |
| CN-10 | DORA: where an incident is classified as major more than 24 hours after awareness, the initial notification is due within 4 hours of that classification. |
| CN-11 | DORA: the initial notification, intermediate and final reports may go together where regular activities have recovered or the root cause analysis is complete, provided each one's time limit is met. |
| CN-12 | NIS2: a trust service provider sends its incident notification for an incident affecting its trust services within 24 hours, not 72. |
Rules of the Regulatory Notification Operating Procedure that move a clock
| Rule | What it says |
|---|---|
| RN-04 | A decision that cannot be settled must be recorded as Not settled with the time it will be revisited. If it is still not settled [[6]] hours before the regime's first deadline, it is treated as Reportable: the report is made by the deadline on the facts known, saying that the assessment is continuing. A report can be updated or withdrawn; a missed deadline cannot be undone. |
| RN-10 | On each submission, the next report's due time must be entered in the log and in the calendars of its drafter and signatory, with a reminder at [[half]] the time remaining. A request from the authority for an intermediate report is logged as a new due time at once. |
| RN-13 | A report that will miss its deadline must still be made as soon as possible, with the reasons for the delay. A report is never held back to avoid a deadline, and a missed deadline is reported to the executive incident lead at once. |
Settings the calculator and the EXAMPLE read
| Value | Setting |
|---|---|
| 6 | Doubt point (RN-04): hours before a regime's first deadline after which a Not settled decision is treated as Reportable. |
| No | May we use DORA's weekend and bank-holiday rule (CN-09) for the initial notification and the intermediate report? Yes only if you are none of the entities CN-09 excludes and your authority has not withdrawn it. The final report may always use it. |
Bank holidays in [[Member State where the entity is established (Article 26(1))]]
| Date | Enter each bank holiday for this year and next, one per cell. The weekend rule (CN-09) treats them as weekend days. |
|---|
Clock Calculator
One row per incident. Enter the yellow cells; every due time calculates from the clocks in the Timeline Matrix. A blank means that duty does not apply on the answers given.
RD-10 takes the earlier of two limits (CN-04), unless the incident was classified after the awareness limit had passed (CN-10). One month runs to the same date next month, at 23:59; where that date does not exist, to the last day of that month.
| Row | Incident | Aware at | NIS2: significant incident? | GDPR: notify the supervisory authority? | DORA: major incident? | DORA: classified as major at | NIS2 incident notification made at | NIS2: handling ended at (only after a progress report) | DORA initial notification made at | DORA latest intermediate report made at | RD-01 NIS2 early warning due | RD-02 NIS2 incident notification due | RD-04 NIS2 final report (or progress report) due | RD-04 NIS2 final report after a progress report due | RD-06 GDPR notification due | RD-10 DORA initial notification due | RD-10: which limit applies | RD-11 DORA intermediate report due | RD-12 DORA final report due | RD-10 latest under the weekend rule (CN-09) | RD-11 latest under the weekend rule (CN-09) | RD-12 latest under the weekend rule (CN-09) | Check |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | INC-2026-014 | 12 Aug 2026 | Yes | No | No | 14 Aug 2026 | 13 Aug 2026 | 15 Aug 2026 | 14 Sep 2026 | OK | |||||||||||||
| EXAMPLE | INC-2026-016 | 9 Sep 2026 | No | Yes | No | 12 Sep 2026 | OK | ||||||||||||||||
| TEST | TEST-1: Classified within the first hours | 5 Jan 2026 | No | No | Yes | 5 Jan 2026 | 5 Jan 2026 | 31 Jan 2026 | 5 Jan 2026 | From classification (CN-04) | 8 Jan 2026 | 28 Feb 2026 | 2 Mar 2026 | OK | |||||||||
| TEST | TEST-2: Classified late on day one: the 24-hour limit wins | 5 Jan 2026 | No | No | Yes | 6 Jan 2026 | 6 Jan 2026 | From awareness (CN-04) | After the initial notification | After the intermediate report | Enter the initial notification time once made | ||||||||||||
| TEST | TEST-3: Classified after 24 hours (CN-10) | 5 Jan 2026 | No | No | Yes | 7 Jan 2026 | 7 Jan 2026 | From classification, classified after the awareness limit (CN-10) | After the initial notification | After the intermediate report | Enter the initial notification time once made | ||||||||||||
| TEST | TEST-4: Deadlines on a Saturday (CN-09) | 9 Jan 2026 | No | No | Yes | 9 Jan 2026 | 9 Jan 2026 | 7 Feb 2026 | 10 Jan 2026 | From classification (CN-04) | 12 Jan 2026 | 7 Mar 2026 | Not available to us (CN-09) | 9 Mar 2026 | OK | ||||||||
| TEST | TEST-5: Not yet classified | 12 Jan 2026 | No | No | Yes | 13 Jan 2026 | From awareness (CN-04) | After the initial notification | After the intermediate report | Enter when it was classified as major |
EXAMPLE
EXAMPLE: the distributor's profile, and one incident's clocks
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders; an important entity under NIS2 in its Member State; not a financial entity, so DORA's reporting duties do not apply; a controller for its customers', staff and suppliers' personal data; it processes no personal data for other controllers.
Its applicability profile (RN-01): where each report goes
| Regime | Applies? | Role | Authority | Channel | Shorter national clock or extra report | Duties |
|---|---|---|---|---|---|---|
| NIS2 | Applies | Important entity, confirmed by the board on 21 May 2026 (P12) | [[national CSIRT, or the competent authority where notifications go to it]] | [[the national notification portal or address, from the national law or the CSIRT's website]] | [[no shorter clock in national law, confirmed by counsel]] | RD-01, RD-02, RD-03, RD-04, RD-05 |
| DORA | Does not apply | Not a financial entity | — | — | — | RD-10, RD-11, RD-12, RD-13 |
| GDPR | Applies | Controller; never a processor for another controller | [[lead supervisory authority, or the supervisory authority of the Member State concerned]] | [[the authority's breach notification form or portal]] | [[none]] | RD-06, RD-07, RD-08, RD-09 |
Its notification signatories (RN-08)
| Channel | Signatory | Deputy | Deputy has tested access since |
|---|---|---|---|
| NIS2 | Information Security Manager | Head of Information Security | 24 Sep 2026 |
| GDPR | Data Protection Officer | Legal | Since adoption |
INC-2026-014: one incident, several clocks
Ransomware on 14 office PCs at Warehouse 2. The security monitoring provider alerted on encryption activity on one office PC at Warehouse 2. It had spread to 14 office PCs on that site's office network before the site was cut off. Ordering and dispatch were not affected.
| Aware at | 12 Aug 2026 | Declared Severity 1; the reporting clocks start (CN-01). |
| Order | Duty | Report | Deadline (P09's words) | Due (calc) | Made | On time? (calc) | Time to spare (calc, h:mm) | What happened |
|---|---|---|---|---|---|---|---|---|
| 1 | RD-01 | NIS2 early warning | Within 24 hours of awareness | 13 Aug 2026 | 12 Aug 2026 | On time | 30 Dec 1899 | Submitted by the Information Security Manager; acknowledged 12 Aug 2026, 16:05. CSIRT initial feedback received at 19:45 with an offer of malware analysis, which was declined (Article 23(5)). |
| 2 | RD-06 | GDPR notification to the supervisory authority | Without undue delay and, where feasible, within 72 hours of awareness; later only with reasons for the delay | 15 Aug 2026 | — | Not made | Would have been due had the breach been a risk; decided Not reportable on 14 Aug, 10:00 (DEC-2026-003) | |
| 3 | RD-02 | NIS2 incident notification | Within 72 hours of awareness | 15 Aug 2026 | 14 Aug 2026 | On time | 30 Dec 1899 | Submitted by the Information Security Manager; acknowledged 14 Aug 2026, 14:20. Quoted the early warning's reference. |
| 4 | RD-04 | NIS2 final report | Within one month of the incident notification (a progress report then, and the final report within one month of handling, if still ongoing) | 14 Sep 2026 | 11 Sep 2026 | On time | 2 Jan 1900 | Submitted by the Information Security Manager; acknowledged 11 Sep 2026, 12:30. Root cause from the post-incident review of 27 Aug 2026. |
Three NIS2 clocks ran from one awareness time; the GDPR clock ran beside them until the breach was settled. DORA never applied: the distributor is not a financial entity, so DORA's reporting duties do not apply.
The decisions on INC-2026-014 (RN-02, RN-04)
| Decision | Regime | Recorded | Outcome | Decided by | Revisit or replaces | Reasons and facts relied on | ||
|---|---|---|---|---|---|---|---|---|
| DEC-2026-001 | NIS2 | 12 Aug 2026, 11:30 | Reportable | Executive incident lead | — | NS-04 met: ransomware spreading across the Warehouse 2 office network, capable of stopping dispatch (NS-01) if it reached the warehouse systems. NS-01 and NS-02 not met on the facts at 11:30. | ||
| DEC-2026-002 | GDPR | 12 Aug 2026, 11:30 | Not settled | Executive incident lead | Revisit by 14 Aug 2026, 10:00 | Shipping records with customer names and delivery addresses on the encrypted PCs: an availability breach. Whether any data was taken is not yet known. | ||
| DEC-2026-003 | GDPR | 14 Aug 2026, 10:00 | Not reportable | Executive incident lead | Replaces DEC-2026-002 | Unlikely to result in a risk: restored from backup with nothing lost, and the provider's analysis found no sign of data taken (GF-01, GF-07). Recorded under RD-08. | ||
| DEC-2026-004 | DORA | 12 Aug 2026, 11:30 | Not applicable | Executive incident lead | — | Not a financial entity (applicability profile). | ||
| Doubt point check | Value (calc) | |||||||
|---|---|---|---|---|---|---|---|---|
| GDPR doubt point: RD-06 due, less the doubt point hours on the Clock Rules sheet | 15 Aug 2026 | |||||||
| Revisit time set by DEC-2026-002 | 14 Aug 2026 | |||||||
| Settled before the doubt point? | Yes: settled before the doubt point (RN-04) | |||||||
The other notices for INC-2026-014 (P09)
| Duty | Report | Made | Note | |||||
|---|---|---|---|---|---|---|---|---|
| RD-15 | Notice to the cyber insurer | 12 Aug 2026, 11:45 | Insurer's incident line; its panel firm was not needed | |||||
| RD-16 | Crime report | 12 Aug 2026, 17:10 | Reported to [[the national cybercrime reporting service]] | |||||
Lists
| YesNo | Regime |
|---|---|
| Yes | NIS2 |
| No | GDPR |
DORA
Contract
Insurance
Law enforcement
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Awareness | The moment the reporting clocks start: the time the incident is declared, as recorded in the case log, unless the record shows we had reasonable certainty earlier, in which case the earlier time. |
| Significant incident (NIS2) | NIS2's term: an incident that has caused or could cause severe operational disruption or financial loss to us, or considerable damage to others. Reported to the authority on NIS2's clock. |
| Major ICT-related incident (DORA) | DORA's term, for financial entities only: an ICT-related incident with a high adverse impact on systems that support critical or important functions, as tested by Delegated Regulation (EU) 2024/1772. |
| Personal data breach (GDPR) | GDPR's term: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. |
| Regime | A body of law that sets its own reporting duty: NIS2, DORA or the GDPR. Contracts, insurance policies and crime reporting add duties of their own, which P09 lists beside them. |
| Applicability profile | The standing record, made before any incident, of which regimes can apply to us at all, in which role, and which authority each report goes to (RN-01). |
| Reportability decision | The recorded answer, for one incident and one regime, to whether a report is due: Reportable, Not reportable, Not applicable or Not settled, with the reasons and the facts it rests on (RN-02). |
| Not settled | A decision that cannot yet be made because a fact the test needs is still unknown. It always carries the time it will be revisited and is never left open past the doubt point (RN-04). |
| Doubt point | The time, a fixed number of hours before a regime's first deadline, after which an unsettled decision is treated as Reportable and the report made on the facts known (RN-04). |
| Fact base | The one record of the incident's facts that every report is drafted from, so reports to different authorities agree (RN-11). |
| Early warning (NIS2) | NIS2's first report, within 24 hours of awareness. It says whether the incident is suspected to be unlawful or malicious, and whether it could have a cross-border impact. |
| Incident notification (NIS2) | NIS2's second report, within 72 hours of awareness. It updates the early warning with an initial assessment of severity and impact and any indicators of compromise. |
| Intermediate report | A report of progress made between the first and the final report: under NIS2, when the authority asks for one; under DORA, on a fixed clock. |
| Final report | The last report, once the cause and actual impact are known: under NIS2, within one month of the incident notification; under DORA, within one month of the latest intermediate report. |
| Progress report (NIS2) | Under NIS2, the report made at the final report's deadline when the incident is still being handled. The final report then follows within one month of handling ending. |
| Initial notification (DORA) | DORA's first report for a major ICT-related incident: within 4 hours of classifying it as major, and no later than 24 hours after becoming aware of it. |
| Classification (DORA) | Under DORA, the financial entity's decision that an ICT-related incident is major, made by applying the criteria and thresholds of Delegated Regulation (EU) 2024/1772. The DORA clock runs from it as well as from awareness. |
| Significant cyber threat | A threat that could cause a significant or major incident but has not yet done so. NIS2 asks us to tell affected recipients what they can do about it; DORA lets financial entities notify one voluntarily. |
| Notification signatory | A person named in advance with the authority to submit reports in the organisation's name, and with working access to the channel each regime uses (RN-08). |
| Lead supervisory authority (GDPR) | Under the GDPR, the supervisory authority of the controller's main establishment, which receives the notification where processing crosses borders inside the EU. Otherwise the authority of the Member State concerned. |
| Phased notification | Giving the information a report needs in stages, as it becomes known, without undue further delay. The GDPR allows it in terms; NIS2 and DORA build it into their staged reports. |
| Late report | A report made after its deadline. It is still made, as soon as possible, and says why it is late. A report is never held back because its deadline has passed. |
| Trust service provider | A provider of trust services such as electronic signatures, seals and time stamps. NIS2 gives it a shorter clock for its incident notification (CN-12). |
| Financial entity | An organisation DORA applies to, such as a bank, insurer, investment firm or payment institution. Only financial entities report under DORA. |
| CSIRT | Computer security incident response team: the national team that receives NIS2 reports, or the competent authority where the national law sends them there instead. |
| RD-01 to RD-16 | P09's reporting duties, each with its deadline and recipient, from the Incident Classification, Severity & Escalation Matrix. |
| CN-01 to CN-12 | The clock rules on the Clock Rules sheet. |
| RN-01 to RN-18 | The rules of the Regulatory Notification Operating Procedure. |
| FB-01 to FB-19 | The fields of the fact base, on the Report Content sheet. |
| CT-04, CT-06, CT-07, CT-08 | P09's approved message templates, in the Incident Communications Template Set. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, Q3 2026. Delete before approval. |
| TEST | A row of test inputs that shows each DORA limit in the calculator. It is not a worked example. Delete before approval. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.5 — Contact with authorities | Recipient and Channel columns, and the EXAMPLE profile: the authorities to contact, kept current |
| ISO/IEC 27001:2022 | Annex A 5.31 — Legal, statutory, regulatory and contractual requirements | The matrix as a whole: each legal and regulatory reporting requirement, with its trigger, deadline and content |
| NIST CSF 2.0 | RS.CO-02 — “Internal and external stakeholders are notified of incidents” | Timeline Matrix and Clock Calculator: authorities, clients and individuals notified of incidents on time |
| NIS2 — Directive (EU) 2022/2555 | Article 23(1) — notify the CSIRT or competent authority, without undue delay, of any significant incident; where appropriate, notify the recipients of the services of significant incidents likely to adversely affect those services | RD-05 row: recipients of our services told of a significant incident likely to affect their service |
| NIS2 — Directive (EU) 2022/2555 | Article 23(2) — where applicable, communicate without undue delay to the recipients of the services potentially affected by a significant cyber threat any measures or remedies they can take in response; where appropriate, also inform them of the threat itself | RD-05 row and content: measures recipients can take against a significant cyber threat |
| NIS2 — Directive (EU) 2022/2555 | Article 23(4)(a) — “without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning”, which where applicable indicates whether the incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact | RD-01 row and the calculator: the early warning within 24 hours of awareness |
| NIS2 — Directive (EU) 2022/2555 | Article 23(4)(b) — “without undue delay and in any event within 72 hours of becoming aware of the significant incident, an incident notification”, which where applicable updates the early warning and gives an initial assessment of the incident, including its severity and impact, and, where available, the indicators of compromise | RD-02 row and the calculator: the incident notification |
| NIS2 — Directive (EU) 2022/2555 | Article 23(4)(c) — “upon the request of a CSIRT or, where applicable, the competent authority, an intermediate report on relevant status updates” | RD-03 row: the intermediate report on the authority's request |
| NIS2 — Directive (EU) 2022/2555 | Article 23(4)(d) — a final report not later than one month after the incident notification, including: (i) a detailed description of the incident, including its severity and impact; (ii) the type of threat or root cause likely to have triggered it; (iii) applied and ongoing mitigation measures; (iv) where applicable, its cross-border impact | RD-04 row, its content and the calculator: the final report one month after the incident notification |
| NIS2 — Directive (EU) 2022/2555 | Article 23(4)(e) — if the incident is still ongoing when the final report is due, a progress report at that time and a final report within one month of the entity’s handling of the incident | RD-04 and CN-03: the progress report, and the final report after it, in the calculator |
| NIS2 — Directive (EU) 2022/2555 | Article 23(4), second subparagraph — by derogation from point (b), a trust service provider notifies significant incidents that have an impact on the provision of its trust services “without undue delay and in any event within 24 hours of becoming aware of the significant incident” | The trust service provider row and CN-12 |
| NIS2 — Directive (EU) 2022/2555 | Article 23(5) — the CSIRT or competent authority responds without undue delay and where possible within 24 hours of receiving the early warning, with initial feedback and, on request, guidance or operational advice on mitigation; where the incident is suspected to be criminal, it also gives guidance on reporting it to law enforcement | RD-01 content: help asked of the CSIRT; the CSIRT's feedback in the EXAMPLE |
| NIS2 — Directive (EU) 2022/2555 | Article 4(1) — where a sector-specific Union legal act requires entities to notify significant incidents with requirements at least equivalent in effect, the relevant provisions of NIS2 do not apply to those entities | Instructions, financial entities: where DORA's reporting takes the place of NIS2's |
| DORA — Regulation (EU) 2022/2554 | Article 1(2) — for financial entities identified as essential or important entities under NIS2, DORA “shall be considered a sector-specific Union legal act for the purposes of Article 4” of NIS2 | Instructions, financial entities: DORA as the sector-specific act for NIS2 entities |
| DORA — Regulation (EU) 2022/2554 | Article 19(1) — report major ICT-related incidents to the relevant competent authority | RD-10 to RD-12 rows: major ICT-related incidents reported to the financial competent authority |
| DORA — Regulation (EU) 2022/2554 | Article 19(2) — financial entities may voluntarily notify significant cyber threats to the relevant competent authority when they deem the threat relevant to the financial system, service users or clients | The voluntary notification row: significant cyber threats |
| DORA — Regulation (EU) 2022/2554 | Article 19(3) — where a major ICT-related incident has an impact on the financial interests of clients, inform them without undue delay of the incident and of the measures taken | RD-13 row: clients whose financial interests are affected |
| DORA — Regulation (EU) 2022/2554 | Article 19(4) — an initial notification, an intermediate report, and a final report when the root cause analysis is complete and actual impact figures are available | RD-10 to RD-12 rows: the initial notification, intermediate report and final report |
| DORA — Delegated Regulation (EU) 2025/301 | Article 5 — initial notification within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it; intermediate report within 72 hours of the initial notification; final report no later than one month after the latest intermediate report | RD-10 to RD-12 in the calculator: each report's time limit |
| DORA — Delegated Regulation (EU) 2025/301 | Article 5(2) — where an incident is classified as major only after 24 hours from becoming aware of it, the initial notification is due within four hours of that classification | CN-10 and the calculator's RD-10 limit: classified after 24 hours from awareness |
| DORA — Delegated Regulation (EU) 2025/301 | Article 5(4) — where a time limit falls on a weekend day or a bank holiday in the reporting entity’s Member State, the notification or report may be submitted “by noon of the next working day” | CN-09 and the calculator's weekend columns |
| DORA — Delegated Regulation (EU) 2025/301 | Article 5(5) — the weekend and bank-holiday rule does not apply to the initial notification or intermediate report of credit institutions, central counterparties, operators of trading venues, and financial entities identified as essential or important entities under NIS2 Article 3 | CN-09 and the weekend setting: the entities that may not use it for the first two reports |
| DORA — Implementing Regulation (EU) 2025/302 | Article 2 — the initial notification, intermediate report and final report may be combined, two or all at once, where regular activities have recovered or the root cause analysis is complete, provided the Article 5 time limits of Delegated Regulation (EU) 2025/301 are met | CN-11: reports combined where each one's time limit is met |
| GDPR — Regulation (EU) 2016/679 | Article 33(1) — notify the supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons; a later notification gives reasons for the delay | RD-06 row and the calculator; CN-06: 72 hours as the outer limit |
| GDPR — Regulation (EU) 2016/679 | Article 33(2) — “The processor shall notify the controller without undue delay after becoming aware of a personal data breach.” | RD-09 row: a processor notifies the controller |
| GDPR — Regulation (EU) 2016/679 | Article 33(4) — information not available at once may be provided in phases without undue further delay | RD-06 content: information given in phases |
| GDPR — Regulation (EU) 2016/679 | Article 34(1) — where a breach is likely to result in a high risk to the rights and freedoms of natural persons, communicate it to the data subjects without undue delay | RD-07 row: communication to the people affected |
| GDPR — Regulation (EU) 2016/679 | Article 56(1) — the supervisory authority of the main or single establishment of the controller or processor is competent to act as lead supervisory authority for its cross-border processing, without prejudice to Article 55 | RD-06 recipient: the lead supervisory authority |
| EDPB — Guidelines 9/2022 | Paragraph 69 — for a breach in cross-border processing, notification goes to the lead supervisory authority, not necessarily where the data subjects are or where the breach happened; in doubt, notify at least the local authority where the breach took place | RD-06 recipient: cross-border processing notified to the lead supervisory authority |
| EDPB — Guidelines 9/2022 | Paragraph 73 — for a controller not established in the EU, a representative in a Member State does not trigger the one-stop-shop: the breach is notified to every supervisory authority in whose Member State affected data subjects reside | Instructions, processors and controllers outside the EU: every authority where affected people live |
| GDPR — Regulation (EU) 2016/679 | Article 28(3)(f) — the processing contract stipulates that the processor “assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor” | RD-09 content: what the controller needs from us |
| DORA — Regulation (EU) 2022/2554 | Article 3(13) — “significant cyber threat” means “a cyber threat the technical characteristics of which indicate that it could have the potential to result in a major ICT-related incident or a major operational or security payment-related incident” | The voluntary notification row: what a significant cyber threat is |
| DORA — Delegated Regulation (EU) 2025/301 | Article 1 — every notification and report gives general information: the type of submission; the entity’s name, LEI and type; the name and code of the submitting entity; the entities covered by an aggregated report; contacts for the competent authority; the parent undertaking; and the currency of any amounts | RD-10 content: general information in every DORA report |
| DORA — Delegated Regulation (EU) 2025/301 | Article 2 — the initial notification contains at least: the entity’s incident reference code; date and time of detection and classification; a description; the classification criteria met; the Member States impacted; how it was discovered; its origin where available; whether a business continuity plan was activated; any reclassification from major to non-major; and other relevant information | RD-10 content: the initial notification |
| DORA — Delegated Regulation (EU) 2025/301 | Article 3 — the intermediate report contains at least: the authority’s reference code; date and time of occurrence and of recovery; how the classification criteria were fulfilled; the incident type; threats and techniques used; affected functional areas, business processes and infrastructure; impact on clients’ financial interests; reporting to other authorities; temporary recovery actions; and indicators of compromise where applicable | RD-11 content: the intermediate report |
| DORA — Delegated Regulation (EU) 2025/301 | Article 4 — the final report contains: the root causes; the dates and times of resolution and of addressing the root cause; how the incident was resolved; information for resolution authorities where applicable; direct and indirect costs and losses and financial recoveries; and recurring incidents where applicable | RD-12 content: the final report |
| DORA — Delegated Regulation (EU) 2025/301 | Article 5(6) — competent authorities may also disapply the weekend and bank-holiday rule, for the initial notification and intermediate report, to other entities that are significant or systemic, after notifying them of the decision | CN-09: the authority may withdraw the weekend rule |
| DORA — Delegated Regulation (EU) 2025/301 | Article 6 — a voluntary notification of a significant cyber threat covers: general information; date and time of detection; a description; potential impact on the entity, clients or counterparts; the classification criteria that would have been met had it materialised; its status; preventive actions taken; notifications to others; indicators of compromise; and other relevant information | Report Content, voluntary notification: what it covers |
| DORA — Implementing Regulation (EU) 2025/302 | Article 1 — the Annex I template is used for the initial notification, the intermediate report and the final report | RD-10 to RD-12 template: the Annex I template |
| DORA — Implementing Regulation (EU) 2025/302 | Article 8 — voluntary notifications of significant cyber threats use the Annex III template and follow the Annex IV glossary and instructions, and the information is complete and accurate | The voluntary notification row: the Annex III template |
| GDPR — Regulation (EU) 2016/679 | Article 33(3) — the notification describes the nature of the breach (categories and approximate numbers of people and records), a contact point, the likely consequences, and the measures taken or proposed | RD-06 content: what the notification describes |
| GDPR — Regulation (EU) 2016/679 | Article 33(5) — the controller documents every personal data breach: the facts, its effects and the remedial action taken | RD-08 row and content: every breach recorded |
| GDPR — Regulation (EU) 2016/679 | Article 34(2) — the communication describes the breach “in clear and plain language” and gives at least the information in Article 33(3)(b), (c) and (d) | RD-07 content: what the communication says |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2022/2554 (DORA), Delegated Regulations (EU) 2024/1772 and 2025/301, Implementing Regulation (EU) 2025/302
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.