Purpose
The NIS2 reporting obligation has three cascading deadlines (24h / 72h / 1 month). A missed deadline is personally liability-relevant for the management body (Art. 20 NIS2). This skill orchestrates the notifications and provides the templates.
Inputs
- Classification of the entity (essential / important — Annex I/II)
- Type of incident (cyberattack / system failure / data leak / supply chain incident)
- Time of becoming aware
- Affected services and potential cross-border effects
- Bodies informed in advance (BSI, other supervisory authority, law enforcement)
Procedure
1. Significance threshold (Art. 23(3) NIS2)
An incident is reportable if it:
- causes or may cause severe operational disruptions or significant financial losses , or
- may affect other natural or legal persons through significant material/non-material damage.
2. 24-hour early warning
To the competent authority (in DE: BSI via the online reporting portal), contains:
- Suspicion of unlawful or malicious act
- Cross-border effects
- Status: early warning ("Initial notification")
3. 72-hour initial notification
Complete incident notification with:
- Assessment of severity
- Assessment of risk
- If applicable, indicators of compromise (IoCs)
4. Intermediate report
At the authority's request, no static deadline. Useful for longer-lasting incidents.
5. Final report (within 1 month of initial notification)
- Detailed description of the incident including severity and effects
- Type of underlying threat or cause
- Remedial measures initiated and ongoing
- If applicable, cross-border effects
6. Interlocking with GDPR Art. 33 / 34
If personal data is affected: additional GDPR notification to LfDI/BfDI within 72 h and, if applicable, data subject notification Art. 34.
7. Law enforcement
If a cybercrime is suspected (e.g. §§ 202a, 202c, 303a, 303b StGB): consider reporting to ZAC (Central Contact Point for Cybercrime).
Sources
Statute
- Directive (EU) 2022/2555 (NIS2) — Art. 20, 21, 23, Annex I/II
- NIS2UmsuCG (German implementing act, currently in the legislative process as of 2026-05)
- BSI – NIS2 notes — contact point for the notifications
- Art. 33 GDPR for the GDPR interlocking
Secondary literature
- Eckhardt, NIS2, 1st ed. 2024
- Voigt/Schmitz, Cybersecurity Law, 2nd ed. 2024
Output format
NIS2-MELDUNG — <Vorfall-ID> — <Datum>
I. Einordnung der Einrichtung [wesentlich / wichtig]
II. Erheblichkeit (Art. 23 Abs. 3) [✅ / ❌]
III. Meldekaskade
24h-Frühwarnung Frist: <Datum + 24h> Status: <abgesetzt / offen>
72h-Erstmeldung Frist: <Datum + 72h> Status: <…>
Endbericht Frist: <Datum + 1M> Status: <…>
IV. Inhalte je Meldestufe <Schablonen-Verweise>
V. DSGVO-Verzahnung [N/A / 72h-Meldung erforderlich]
VI. Strafrechtliche Anzeige [N/A / erwägen — § 202a StGB usw.]
Eskalationspfad: <Geschäftsleitung wann / wie>
Nächster Schritt: <…>
Risks / typical mistakes
- 24h deadline begins with becoming aware, not with "confirmation". Delaying tactics cost liability.
- Forgotten GDPR linkage for personal data — duplicate reporting obligation.
- Management not involved — NIS2 explicitly requires training and responsibility of management (Art. 20).
- Supplier incident ignored — security incidents at IT service providers can also be reportable (Art. 21(2)(d)).
- "Malicious act" ticked too hesitantly — tick if suspected (not only once proven).