Regulatory Notification Log
Records each notification decision, submission time, reference number and follow-up obligation.
Available soon
- Format
- Excel
- Size
- 181 KB
- Length
- 13 sheets
- Version
- 1.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | What this log is. The record of every decision on whether an incident must be reported to an authority, and of every report made: who decided, on what facts, when each report was due and when it went. It is your own record, kept in your own systems. The incident manager keeps it. Each signatory adds a submission the moment it is made (RN-09); the Data Protection Officer records the GDPR decisions with the executive incident lead. |
| 2 | Set the As-at time on the Measures sheet. It is the time every overdue flag and days-remaining figure is measured at. During an incident, type =NOW() or the current time; for the quarterly report, the quarter's last day. Set the doubt point (RN-04) there too. |
| 3 | Incidents: open a row for every incident declared in the P09 Incident Case & Action Log, with the same case number, category, severity at declaration and declaration time. The declaration time is awareness, and every clock starts there unless the P09 record shows reasonable certainty earlier. For a financial entity under DORA, enter the time the incident was classified as major. The first due time for each regime calculates, so you can see at once what is coming. |
| 4 | Decisions: within P09's 4 hours of awareness (P09 IM-06), enter one row for each regime: NIS2, GDPR and DORA, even where the answer is Not applicable (RN-02). Choose the outcome: Reportable, Not reportable, Not applicable, Not settled. Name the indicators, thresholds or risk level from the Reportability Decision Model, the facts relied on, and who decided (RN-06). |
| 5 | A Not settled decision needs a revisit time, no later than the doubt point: [[6]] hours before the regime's first deadline (RN-04). Revisit every decision short of Reportable at each P09 update (RN-05). Record the revisit as a new row that names the row it replaces in 'Replaces'; never overwrite the first decision. The Check column flags what is late or missing. |
| 6 | Follow-ups: every Reportable decision opens the regime's first report (NIS2 RD-01, GDPR RD-06, DORA RD-10); add it at once, naming the decision in 'Set by'. Every submission opens the next report, shown in its 'Next report' column; add that too, naming the submission (RN-10). An authority's request for an intermediate report (P09 RD-03) is added the same way, with the due time the authority set. Put each due time in the calendars of the drafter and the signatory, with a reminder at [[half]] the time remaining. |
| 7 | Submissions: on submission, the signatory enters the submission ID, incident, P09 duty, the time it went, the channel, who submitted it, the authority's reference and the time it was acknowledged (RN-09). The due time calculates from P09's clocks: NIS2's early warning 24 hours and incident notification 72 hours from awareness, and its final report one month from the incident notification; the GDPR notification 72 hours from awareness; DORA's initial notification 4 hours from classification and no later than 24 hours from awareness, its intermediate report 72 hours from the initial notification, and its final report one month from the latest intermediate report. Never type over it. Some reports cannot be timed from the first clock: DORA's intermediate report made again on recovery, NIS2's final report after a progress report (one month after handling ended), a time the authority set, or a shorter national clock. For those, enter the due time and its reason in the two yellow columns beside it; the entered time then replaces the calculated one, and 'Due basis' says so. |
| 8 | Other notices: notices under contracts, the cyber insurance policy and crime reports (P09 RD-14 to RD-16). They have no legal clock and are not counted in RNM-02; enter the deadline the contract or policy sets, if it sets one. |
| 9 | Measures: take RNM-01 to RNM-04 to executive management every quarter with P09's measures (RN-18). Copy each readiness check's status from the Notification Readiness Checklist after every check. |
| 10 | Keep the log, and a copy of every report and decision, for at least [[6]] years after each incident is closed (RN-18). It holds incident and personal data details: restrict access to the people in the distribution list. To start your own log, delete the contents of the first column and of every yellow cell on the Incidents, Decisions, Submissions, Follow-ups and Other notices sheets. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Limitations: This document helps you apply the tests in NIS2, DORA and the GDPR to your own facts. It is not legal advice. National law may add to the Directive, and authorities publish their own guidance, forms and portals, so confirm your approach with counsel before you rely on it. The authorities and channels on this workbook are placeholders: [[national CSIRT, or the competent authority where notifications go to it]]; [[lead supervisory authority, or the supervisory authority of the Member State concerned]]; [[financial competent authority designated under DORA Article 46]].
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity under NIS2 in its Member State; not a financial entity, so DORA's reporting duties do not apply; a controller for its customers', staff and suppliers' personal data; it processes no personal data for other controllers. Its log for Q3 2026, as at 30 Sep 2026: 17 decisions on 5 incidents, every first one inside the screen; the ransomware incident (INC-2026-014) reported to the CSIRT in three stages; the order spreadsheet sent to the wrong customer (INC-2026-016) notified to the supervisory authority; the other three incidents not reportable. Every report went on time and nothing is overdue.
A clock that runs from an earlier report starts when that report is entered on Submissions; until then the due time says what it is waiting for. A duty with no fixed clock ("without undue delay") shows "No fixed clock" unless you enter the time an authority, contract or national law set.
Tailoring — small organisation: the Incidents, Decisions and Submissions sheets are the minimum. Keep one Decisions row per regime even when the answer is obvious: a recorded Not applicable is the evidence that the question was asked.
Tailoring — regulated financial entity: DORA replaces NIS2's reporting for financial entities. Enter the classification time on Incidents (the time the incident was found to be major under Delegated Regulation (EU) 2024/1772). The initial notification (RD-10) is then due at the earlier of 4 hours from classification and 24 hours from awareness; where classification comes 24 hours or more after awareness, 4 hours from classification. Each intermediate report (RD-11) moves the final report's due time (RD-12). Where a DORA deadline falls on a weekend or bank holiday, some entities may report by noon of the next working day; the log does not apply this, so its due time is always the safe one. A reclassification to non-major goes on the template as its own submission, with a note. DORA Article 17(2) asks for every ICT-related incident to be recorded: keep this log for all of them.
Tailoring — processor: where you process personal data for another controller, log the notice to the controller (RD-09) as a submission, and enter the contract's deadline, no later than [[24]] hours from awareness (RN-15). The controller decides and notifies.
Tailoring — reporting done by a third party: where a provider submits DORA reports for you (RN-16), it uses this log. You remain responsible for every report and its timing.
Decisions
One row per incident and regime, within P09's 4 hours of awareness, whether or not a report is made (RN-02). A revisit is a new row naming the row it replaces (RN-05). Yellow columns are yours; the others calculate.
| Row | Decision ID | Incident | Regime | Recorded | Outcome | Indicators, thresholds or risk level | Reasons and facts relied on | Decided by | Revisit by | Replaces | Aware at (calc) | Hours after awareness (calc) | Within the 4-hour screen? (calc) | Doubt point (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | DEC-2026-001 | INC-2026-014 | NIS2 | 12 Aug 2026 | Reportable | NS-04 met; NS-01 and NS-02 not met | NS-04 met: ransomware spreading across the Warehouse 2 office network, capable of stopping dispatch (NS-01) if it reached the warehouse systems. NS-01 and NS-02 not met on the facts at 11:30. | Executive incident lead | 12 Aug 2026 | 3.08 | Yes | Recorded within the screen | |||
| EXAMPLE | DEC-2026-002 | INC-2026-014 | GDPR | 12 Aug 2026 | Not settled | Not yet known: whether any data was taken | Shipping records with customer names and delivery addresses on the encrypted PCs: an availability breach. Whether any data was taken is not yet known. | Executive incident lead | 14 Aug 2026 | 12 Aug 2026 | 3.08 | Yes | 15 Aug 2026 | Settled by a later decision | |
| EXAMPLE | DEC-2026-003 | INC-2026-014 | GDPR | 14 Aug 2026 | Not reportable | Unlikely to result in a risk (GF-01, GF-07) | Unlikely to result in a risk: restored from backup with nothing lost, and the provider's analysis found no sign of data taken (GF-01, GF-07). Recorded under RD-08. | Executive incident lead | DEC-2026-002 | 12 Aug 2026 | 49.58 | Revisit | Revisit recorded (RN-05) | ||
| EXAMPLE | DEC-2026-004 | INC-2026-014 | DORA | 12 Aug 2026 | Not applicable | — | Not a financial entity (applicability profile). | Executive incident lead | 12 Aug 2026 | 3.08 | Yes | Recorded within the screen | |||
| EXAMPLE | DEC-2026-005 | INC-2026-015 | NIS2 | 2 Sep 2026 | Not reportable | None met | No indicator met: no service disrupted, no money lost, the call-back check stopped the payment. | Incident manager | 2 Sep 2026 | 1.50 | Yes | Recorded within the screen | |||
| EXAMPLE | DEC-2026-006 | INC-2026-015 | GDPR | 2 Sep 2026 | Not applicable | — | No personal data of ours affected: the compromised mailbox was the supplier's. | Incident manager | 2 Sep 2026 | 1.50 | Yes | Recorded within the screen | |||
| EXAMPLE | DEC-2026-007 | INC-2026-015 | DORA | 2 Sep 2026 | Not applicable | — | Not a financial entity (applicability profile). | Incident manager | 2 Sep 2026 | 1.50 | Yes | Recorded within the screen | |||
| EXAMPLE | DEC-2026-008 | INC-2026-016 | NIS2 | 9 Sep 2026 | Not reportable | None met (NS-03 considered) | No indicator met: no service disrupted; one recipient, a business customer, not damage at scale (NS-03). | Executive incident lead | 9 Sep 2026 | 1.67 | Yes | Recorded within the screen | |||
| EXAMPLE | DEC-2026-009 | INC-2026-016 | GDPR | 9 Sep 2026 | Reportable | Risk (GF-01, GF-03, GF-06); high risk to be settled | Confidentiality breach: names, delivery addresses and order histories of 212 customers sent to the wrong business customer. A risk (GF-01, GF-03, GF-06); whether a high risk to be settled once the recipient confirms deletion. | Executive incident lead | 9 Sep 2026 | 1.67 | Yes | Recorded within the screen | |||
| EXAMPLE | DEC-2026-010 | INC-2026-016 | GDPR | 9 Sep 2026 | Reportable | Risk, not high risk (GF-02, GF-07) | A risk, not a high risk: the recipient confirmed deletion in writing at 16:30, no payment data was included, and the data went to a known business (GF-02, GF-07). Notify the authority (RD-06); individuals not told (RD-07 not due). | Executive incident lead | DEC-2026-009 | 9 Sep 2026 | 5.92 | Revisit | Revisit recorded (RN-05) | ||
| EXAMPLE | DEC-2026-011 | INC-2026-016 | DORA | 9 Sep 2026 | Not applicable | — | Not a financial entity (applicability profile). | Executive incident lead | 9 Sep 2026 | 1.67 | Yes | Recorded within the screen | |||
| EXAMPLE | DEC-2026-012 | INC-2026-017 | NIS2 | 22 Sep 2026 | Not reportable | None met | No indicator met: one mailbox, contained 40 minutes after detection, no service affected. Recorded after the incident was lowered to Severity 3. | Incident manager | 22 Sep 2026 | 0.92 | Yes | Recorded within the screen | |||
| EXAMPLE | DEC-2026-013 | INC-2026-017 | GDPR | 22 Sep 2026 | Not reportable | Not a personal data breach | Not a personal data breach: the mailbox audit log shows no mail was read or forwarded by the attacker. Recorded as assessed. | Incident manager | 22 Sep 2026 | 0.92 | Yes | Recorded within the screen | |||
| EXAMPLE | DEC-2026-014 | INC-2026-017 | DORA | 22 Sep 2026 | Not applicable | — | Not a financial entity (applicability profile). | Incident manager | 22 Sep 2026 | 0.92 | Yes | Recorded within the screen | |||
| EXAMPLE | DEC-2026-015 | INC-2026-018 | NIS2 | 29 Sep 2026 | Not reportable | None met | No indicator met: every attempt blocked, the system already patched. | Incident manager | 29 Sep 2026 | 0.67 | Yes | Recorded within the screen | |||
| EXAMPLE | DEC-2026-016 | INC-2026-018 | GDPR | 29 Sep 2026 | Not applicable | — | No personal data affected. | Incident manager | 29 Sep 2026 | 0.67 | Yes | Recorded within the screen | |||
| EXAMPLE | DEC-2026-017 | INC-2026-018 | DORA | 29 Sep 2026 | Not applicable | — | Not a financial entity (applicability profile). | Incident manager | 29 Sep 2026 | 0.67 | Yes | Recorded within the screen |
Submissions
One row per report made to an authority, to the people affected or to a controller under P09's duties RD-01 to RD-13, entered by the signatory on submission (RN-09). The due time calculates from P09's clocks; never type over it.
| Row | Submission ID | Incident | Duty | Report (calc) | Aware at (calc) | Clock starts at (calc) | Entered due time (replaces the calculated one) | Reason for the entered due time | Due (calc) | Due basis (calc) | Submitted | On time (calc) | Channel | Submitted by | Authority reference | Acknowledged | Next report (calc) | Next due (calc) | Due this quarter? (RNM-02) | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | SB-2026-001 | INC-2026-014 | RD-01 | NIS2 early warning | 12 Aug 2026 | 12 Aug 2026 | 13 Aug 2026 | Calculated from P09's clock | 12 Aug 2026 | On time | [[the national notification portal or address, from the national law or the CSIRT's website]] | Information Security Manager | [[authority's reference]] | 12 Aug 2026 | RD-02 | 15 Aug 2026 | Yes | CSIRT initial feedback received at 19:45 with an offer of malware analysis, which was declined (Article 23(5)). | ||
| EXAMPLE | SB-2026-002 | INC-2026-014 | RD-02 | NIS2 incident notification | 12 Aug 2026 | 12 Aug 2026 | 15 Aug 2026 | Calculated from P09's clock | 14 Aug 2026 | On time | [[the national notification portal or address, from the national law or the CSIRT's website]] | Information Security Manager | [[authority's reference]] | 14 Aug 2026 | RD-04 | 14 Sep 2026 | Yes | Quoted the early warning's reference. | ||
| EXAMPLE | SB-2026-003 | INC-2026-014 | RD-04 | NIS2 final report | 12 Aug 2026 | 14 Aug 2026 | 14 Sep 2026 | Calculated from P09's clock | 11 Sep 2026 | On time | [[the national notification portal or address, from the national law or the CSIRT's website]] | Information Security Manager | [[authority's reference]] | 11 Sep 2026 | — | Yes | Root cause from the post-incident review of 27 Aug 2026. | |||
| EXAMPLE | SB-2026-004 | INC-2026-016 | RD-06 | GDPR notification to the supervisory authority | 9 Sep 2026 | 9 Sep 2026 | 12 Sep 2026 | Calculated from P09's clock | 11 Sep 2026 | On time | [[the authority's breach notification form or portal]] | Data Protection Officer | [[authority's reference]] | 11 Sep 2026 | — | Yes | No information left to follow; no reasons for delay needed. |
Follow-ups
Every report still owed or already made: one row for each report a decision or a submission opened (RN-10). Days remaining and Status are measured at the As-at time on the Measures sheet. Filter Status to see what is open.
| Row | Incident | Duty | Report (calc) | Set by (decision or submission) | Entered due time (replaces the calculated one) | Reason for the entered due time | Clock starts at (calc) | Due (calc) | Due basis (calc) | Made (calc, from Submissions) | Days remaining (calc) | Status (calc) | Drafter | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | INC-2026-014 | RD-01 | NIS2 early warning | DEC-2026-001 | 12 Aug 2026 | 13 Aug 2026 | Calculated from P09's clock | 12 Aug 2026 | Made on time | Incident manager | ||||
| EXAMPLE | INC-2026-014 | RD-02 | NIS2 incident notification | SB-2026-001 | 12 Aug 2026 | 15 Aug 2026 | Calculated from P09's clock | 14 Aug 2026 | Made on time | Incident manager | ||||
| EXAMPLE | INC-2026-014 | RD-04 | NIS2 final report | SB-2026-002 | 14 Aug 2026 | 14 Sep 2026 | Calculated from P09's clock | 11 Sep 2026 | Made on time | Incident manager | ||||
| EXAMPLE | INC-2026-016 | RD-06 | GDPR notification to the supervisory authority | DEC-2026-009 | 9 Sep 2026 | 12 Sep 2026 | Calculated from P09's clock | 11 Sep 2026 | Made on time | Data Protection Officer |
Other notices
Notices under contracts, the cyber insurance policy and crime reports (P09 RD-14 to RD-16). No legal clock: enter the deadline the contract or policy sets, if any. Not counted in RNM-02.
| Row | Incident | Duty | Notice (calc) | Recipient | Deadline set by the contract or policy | Made | Made by | Hours after awareness (calc) | Result (calc) | Notes |
|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | INC-2026-014 | RD-15 | Insurance: notice to the cyber insurer | [[insurer or broker incident line]] | 12 Aug 2026 | Executive incident lead | 3.33 | Made | Insurer's incident line; its panel firm was not needed | |
| EXAMPLE | INC-2026-014 | RD-16 | Law enforcement: crime report | [[national cybercrime reporting service]] | 12 Aug 2026 | Legal | 8.75 | Made | Reported to [[the national cybercrime reporting service]] | |
| EXAMPLE | INC-2026-015 | RD-16 | Law enforcement: crime report | [[national cybercrime reporting service]] | 2 Sep 2026 | 3.83 | Made | Attempted payment fraud reported to [[the national fraud reporting service]]; the insurer was not told, as nothing was lost and the policy does not ask for attempts |
Incidents
Each declared incident, copied from the P09 Incident Case & Action Log: the formulas read its awareness time, severity at declaration and DORA classification time. The first due time for each regime shows what falls due if the decision is Reportable.
| Row | Incident | Title | Category ID | Category (calc) | Severity at declaration | Severity now | Severity changed at | Declared (awareness) | DORA: classified as major at | Closed | Screen due (4 hours, calc) | Regimes decided within the screen (calc) | All decided within the screen? (RNM-01, calc) | Declared this quarter? (calc) | NIS2: early warning due if reportable (RD-01, calc) | GDPR: notification to the supervisory authority due if reportable (RD-06, calc) | DORA: initial notification due if reportable (RD-10, calc) | Reports made (calc) | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | INC-2026-014 | Ransomware on 14 office PCs at Warehouse 2 | IC-01 | Ransomware or destructive malware | Severity 1 | Severity 1 | 12 Aug 2026 | 21 Aug 2026 | 12 Aug 2026 | 3 | Yes | Yes | 13 Aug 2026 | 15 Aug 2026 | 13 Aug 2026 | 3 | From the P09 case log. | ||
| EXAMPLE | INC-2026-015 | Request to change a supplier's bank details from its compromised mailbox | IC-03 | Business email compromise and payment fraud | Severity 3 | Severity 3 | 2 Sep 2026 | 4 Sep 2026 | 2 Sep 2026 | 3 | Yes | Yes | 3 Sep 2026 | 5 Sep 2026 | 3 Sep 2026 | 0 | From the P09 case log. | ||
| EXAMPLE | INC-2026-016 | Customer order spreadsheet sent to the wrong business customer | IC-05 | Personal data breach | Severity 2 | Severity 2 | 9 Sep 2026 | 16 Sep 2026 | 9 Sep 2026 | 3 | Yes | Yes | 10 Sep 2026 | 12 Sep 2026 | 10 Sep 2026 | 1 | From the P09 case log. | ||
| EXAMPLE | INC-2026-017 | Staff mailbox taken over after a phishing email | IC-04 | Account compromise | Severity 2 | Severity 3 | 22 Sep 2026 | 22 Sep 2026 | 24 Sep 2026 | 22 Sep 2026 | 3 | Yes | Yes | 23 Sep 2026 | 25 Sep 2026 | 23 Sep 2026 | 0 | From the P09 case log. Lowered to Severity 3 at 22 Sep 2026, 15:20. | |
| EXAMPLE | INC-2026-018 | Blocked attempts to exploit a published weakness on the ordering platform | IC-06 | Exploited vulnerability | Severity 4 | Severity 4 | 29 Sep 2026 | 29 Sep 2026 | 3 | Yes | Yes | 30 Sep 2026 | 2 Oct 2026 | 30 Sep 2026 | 0 | From the P09 case log. |
Measures
Measures
Every figure is calculated from the Incidents, Decisions, Submissions and Follow-ups sheets at the As-at time, and from the readiness statuses below. Report them to executive management every quarter with P09's (RN-18).
| As-at time | 30 Sep 2026 | EXAMPLE: the quarter's last minute. During an incident, type =NOW(). |
| Quarter start (calc) | 1 Jul 2026 | The first day of the calendar quarter of the As-at time. |
| Reporting screen (hours from awareness) | 4 | P09 IM-06. Every decision is recorded within it (RN-02). |
| Doubt point (hours before a regime's first deadline) | 6 | RN-04. An unsettled decision is treated as Reportable from then. |
Headline measures for the quarter
| Measure | Result | Out of | Target | Status | What it means |
|---|---|---|---|---|---|
| RNM-01 Decisions on time | 5 | 5 | All | On target | Declared incidents with a decision for every regime in the profile recorded within 4 hours of declaration, out of all declared in the quarter. Result: decided on time; out of: declared. |
| RNM-02 Reports made on time (P09 IMM-02) | 4 | 4 | All | On target | P09's measure, unchanged: Reports to authorities and individuals made by their deadline, out of all that fell due in the quarter. Out of: reports due this quarter, made or still owed. Notices without a legal clock are not counted. |
| RNM-03 Follow-up reports overdue | 0 | 0 | None | On target | Reports past their due time and not yet made, at the quarter end. Out of: every report still owed at the As-at time. |
| RNM-04 Readiness: checks Ready | 13 | 16 | Every blocking check Ready | On target | Readiness checks Ready, out of those that apply, at the last check; and blocking checks not Ready. Out of: checks that apply. |
| RNM-04 Readiness: blocking checks not Ready | 0 | None | On target | A blocking check stops a report being made on time if it is missing (Notification Readiness Checklist). |
EXAMPLE results for Q3 2026: RNM-01 5 of 5; RNM-02 4 of 4; RNM-03 0; RNM-04 13 of 16; blocking not Ready: 0.
Readiness at the last check
| Date of the last readiness check | 25 Sep 2026 | EXAMPLE: the re-check of 25 Sep 2026, after the first check of 18 Sep 2026. Copy each status from the Notification Readiness Checklist. |
| Check | Blocking | Status | |
|---|---|---|---|
| RC-01 The applicability profile is approved and was reviewed in the last 12 months | Yes | Ready | |
| RC-02 The NIS2 classification is confirmed in writing (P12) and the registration details held by the authority are current | No | Ready | |
| RC-03 Any shorter national clock or extra report is entered in the profile | No | Ready | |
| RC-04 Each authority in the profile is named, with its channel, address and telephone number | Yes | Ready | |
| RC-05 Each authority's out-of-hours contact is known and was checked in the last 12 months | No | Partly ready | |
| RC-06 Language and format each authority accepts are recorded, including any form it requires | No | Ready | |
| RC-07 Every signatory is named in writing, with a deputy, for each channel | Yes | Ready | |
| RC-08 Every signatory and deputy has working access to each channel, tested in the last 12 months, with sign-in that does not depend on one person's device | Yes | Ready | |
| RC-09 The decider and the template approvers each have a named deputy, reachable out of hours | Yes | Ready | |
| RC-10 Legal's out-of-hours contact is known, and Legal has agreed the review time limit | No | Partly ready | |
| RC-11 The NIS2 and personal data breach templates are current, with the entity's details already filled in | No | Ready | |
| RC-12 The fact base form and the log are set up and reachable during an outage of the main systems | Yes | Ready | |
| RC-13 Templates for notices to customers and individuals are approved in advance (P09 CT-04, CT-08) | No | Ready | |
| RC-14 Contracts with suppliers that hold our data or run our services carry the incident notification clause, with notice within [[24]] hours (P06 CL-07) | No | Ready | |
| RC-15 Where we act as a processor, each controller's breach contact and contractual notice period is recorded | No | Not applicable | |
| RC-16 Where a third party submits DORA reports for us, the contract and its access are in place | No | Not applicable | |
| RC-17 Notification decisions and a report were rehearsed in an exercise in the last 12 months (P10) | No | Partly ready | |
| RC-18 The log holds every decision and report since the last check, with references | No | Ready | |
| Readiness result (calc) | Ready with gaps | Not ready where any blocking check is Not ready; Ready with gaps where any check is short of Ready. |
Quarterly report record
| Item | Entry | ||||
|---|---|---|---|---|---|
| Reported to executive management by (name, role) and date | [[Name, role, YYYY-MM-DD]] | ||||
| Reports late or overdue this quarter, and why | [[e.g. none; or the report, the reason and what has changed (RN-13)]] | ||||
| Readiness gaps and their actions | [[e.g. the actions from the last check, with owners and due dates]] | ||||
Lists
| Regime | Outcome | Decider | DutyID | DutyReport | DutyClock | DutyHours | DutyPrior | DutyNext | OtherDutyID | OtherDutyReport | CategoryID | CategoryName | SeverityName | ReadyWord | ClassifyHours | DueReason |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| NIS2 | Reportable | Executive incident lead | RD-01 | NIS2 early warning | Hours from awareness | 24 | — | RD-02 | RD-14 | Contract: notice to customers under contract | IC-01 | Ransomware or destructive malware | Severity 1 | Ready | 4 | On recovery (DORA intermediate report) |
| GDPR | Not reportable | Incident manager | RD-02 | NIS2 incident notification | Hours from awareness | 72 | — | RD-04 | RD-15 | Insurance: notice to the cyber insurer | IC-02 | Other malware | Severity 2 | Partly ready | One month after handling ended (NIS2 final report after a progress report) | |
| DORA | Not applicable | RD-03 | NIS2 intermediate report | No fixed clock | — | — | — | RD-16 | Law enforcement: crime report | IC-03 | Business email compromise and payment fraud | Severity 3 | Not ready | Set by the authority | ||
| Not settled | RD-04 | NIS2 final report | One month from the earlier report | — | RD-02 | — | IC-04 | Account compromise | Severity 4 | Not applicable | Shorter clock in national law | |||||
| RD-05 | NIS2 notice to recipients of our services | No fixed clock | — | — | — | IC-05 | Personal data breach | Set by a contract | ||||||||
| RD-06 | GDPR notification to the supervisory authority | Hours from awareness | 72 | — | — | IC-06 | Exploited vulnerability | |||||||||
| RD-07 | GDPR communication to the individuals affected | No fixed clock | — | — | — | IC-07 | Denial of service | |||||||||
| RD-08 | GDPR breach record | No fixed clock | — | — | — | IC-08 | Insider misuse | |||||||||
| RD-09 | GDPR notice to the controller | No fixed clock | — | — | — | IC-09 | Lost or stolen device | |||||||||
| RD-10 | DORA initial notification | DORA initial notification | 24 | — | RD-11 | IC-10 | Supplier incident | |||||||||
| RD-11 | DORA intermediate report | Hours from the earlier report | 72 | RD-10 | RD-12 | |||||||||||
| RD-12 | DORA final report | One month from the earlier report | — | RD-11 | — | |||||||||||
| RD-13 | DORA notice to clients | No fixed clock | — | — | — |
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Awareness | The moment the reporting clocks start: the time the incident is declared, as recorded in the case log, unless the record shows we had reasonable certainty earlier, in which case the earlier time. |
| Reportability decision | The recorded answer, for one incident and one regime, to whether a report is due: Reportable, Not reportable, Not applicable or Not settled, with the reasons and the facts it rests on (RN-02). |
| Reportable | The test is met. The regime's clocks run, the reports are drafted and the log shows each due time. |
| Not reportable | The regime applies to us, and the test is not met. The reasons are recorded; for the GDPR the breach is still recorded (RD-08). |
| Not applicable | The regime cannot apply to us, or not to this incident (for example, no personal data involved). Said once, with the reason. |
| Not settled | A fact the test needs is unknown. The decision carries the time it will be revisited, never later than the doubt point (RN-04). |
| Doubt point | The time, a fixed number of hours before a regime's first deadline, after which an unsettled decision is treated as Reportable and the report made on the facts known (RN-04). |
| Submission | Sending a report through the authority's channel, by a signatory who holds access to it, and recording the time, the channel and any reference the authority returns (RN-08, RN-09). |
| Authority reference | The case or reference number the authority returns for a report. Every later report for the same incident quotes it. |
| Signatory | A person named in advance with the authority to submit reports in the organisation's name, and with working access to the channel each regime uses (RN-08). |
| Late report | A report made after its deadline. It is still made, as soon as possible, and says why it is late. A report is never held back because its deadline has passed. |
| Early warning (NIS2) | NIS2's first report, within 24 hours of awareness. It says whether the incident is suspected to be unlawful or malicious, and whether it could have a cross-border impact. |
| Incident notification (NIS2) | NIS2's second report, within 72 hours of awareness. It updates the early warning with an initial assessment of severity and impact and any indicators of compromise. |
| Intermediate report | A report of progress made between the first and the final report: under NIS2, when the authority asks for one; under DORA, on a fixed clock. |
| Final report | The last report, once the cause and actual impact are known: under NIS2, within one month of the incident notification; under DORA, within one month of the latest intermediate report. |
| Initial notification (DORA) | DORA's first report for a major ICT-related incident: within 4 hours of classifying it as major, and no later than 24 hours after becoming aware of it. |
| Classification (DORA) | Under DORA, the financial entity's decision that an ICT-related incident is major, made by applying the criteria and thresholds of Delegated Regulation (EU) 2024/1772. The DORA clock runs from it as well as from awareness. |
| Reclassification (DORA) | Under DORA, changing a reported incident from major to non-major, or the other way, when new facts show the first classification was wrong. It is reported, never made silently. |
| Regime | A body of law that sets its own reporting duty: NIS2, DORA or the GDPR. Contracts, insurance policies and crime reporting add duties of their own, which P09 lists beside them. |
| Clock starts at | The time a report's clock runs from: awareness for the first reports, or the time the earlier report it waits for was made (NIS2's final report waits for the incident notification; DORA's intermediate report for the initial notification, and its final report for the latest intermediate report). |
| Due | When the report must be made, from P09's clock, exactly as P18 calculates it. One month ends at 23:59 on the same date of the next month, or on that month's last day where it has no such date. An entered due time, with its reason, replaces the calculated one ('Due basis' shows which). |
| Within the screen | Recorded no later than P09's 4 hours after awareness (P09 IM-06). A revisit is not measured against the screen. |
| Days remaining | The days from the As-at time to the due time, for a report not yet made. Negative once it is overdue. |
| Breach record (GDPR) | Breach record: P09 RD-08. Every personal data breach is recorded, notified or not. A GDPR row on the Decisions sheet with its reasons, kept with the P09 case log, is that record. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| RN-nn, RD-nn, IM-nn, NS-nn, GF-nn, DC-nn | The rules of the Regulatory Notification Operating Procedure (RN-02, RN-04, RN-05, RN-06, RN-09, RN-10, RN-13 and RN-18 are the ones this log records); P09's reporting duties and rules; and the NIS2 indicators, GDPR risk factors and DORA criteria of the Reportability Decision Model. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, Q3 2026, as at 30 Sep 2026. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.5 — Contact with authorities | Submissions: every contact with an authority recorded, with the channel, reference and acknowledgement |
| NIST CSF 2.0 | RS.CO-02 — “Internal and external stakeholders are notified of incidents” | Submissions and Follow-ups: each notification to an authority, to the people affected or to a controller, made and tracked to its due time |
| NIST CSF 2.0 | RS.CO-03 — “Information is shared with designated internal and external stakeholders” | Submissions: the information shared with each authority, with a copy of what was sent and the authority's reference |
| NIS2 — Directive (EU) 2022/2555 | Article 23(4) — an early warning within 24 hours of becoming aware of a significant incident; an incident notification within 72 hours; an intermediate report on request; a final report not later than one month after the incident notification (or a progress report, then a final report within one month of handling, if still ongoing) | Submissions: the early warning, incident notification and final report, each due time calculated from Article 23(4)'s clocks |
| DORA — Regulation (EU) 2022/2554 | Article 17(2) — record all ICT-related incidents and significant cyber threats, and ensure root causes are identified, documented and addressed | Decisions: every ICT-related incident recorded with its decision, for financial entities |
| DORA — Regulation (EU) 2022/2554 | Article 19(4) — an initial notification, an intermediate report, and a final report when the root cause analysis is complete and actual impact figures are available | Submissions and Follow-ups: the initial notification, intermediate and final reports, each due time from the earlier report |
| DORA — Implementing Regulation (EU) 2025/302 | Article 5 — where further assessment shows that an incident reported as major at no time met the Article 8 criteria of Delegated Regulation (EU) 2024/1772, the entity notifies the authority that it has reclassified it as non-major, using the template fields ‘type of report’ and ‘other information’ | Submissions: a reclassification to non-major logged as its own submission |
| GDPR — Regulation (EU) 2016/679 | Article 33(1) — notify the supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons; a later notification gives reasons for the delay | Submissions: the notification due 72 hours from awareness, and whether it was made in time |
| GDPR — Regulation (EU) 2016/679 | Article 33(5) — the controller documents every personal data breach: the facts, its effects and the remedial action taken | Decisions: every personal data breach documented with the risk decision and its reasons, notified or not |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2022/2554 (DORA), Delegated Regulations (EU) 2024/1772 and 2025/301, Implementing Regulation (EU) 2025/302
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.