Directive (EU) 2022/2555

NIS2’s 24-hour, 72-hour, and one-month sequence

Turn the directive’s staged reporting into an incident workflow that works outside office hours.

Written and reviewed by Fredrik Surtell ·

What must a NIS2 incident process produce over time?

For a significant incident, the directive sets an early warning within 24 hours, an incident notification within 72 hours, updates or intermediate reporting when requested, and a final report normally within one month.

Operating sequence

  1. 01

    Define the national significant-incident criteria and the exact awareness evidence.

  2. 02

    Create one evolving fact record with separate approved projections for each reporting stage.

  3. 03

    Staff the decision, authority contact, communication, and supplier escalation paths outside office hours.

Failure modes to avoid

  • Submitting the same static form at every stage.
  • Waiting for technical certainty before the early warning.
  • Forgetting service-recipient communication where the law requires it.

The source remains the authority.

NIS2 Directive Article 23 — EUR-Lex