NIS2

NIS2 Article 23

Article 23 is the incident report. An early warning goes out within 24 hours of becoming aware of a significant incident. An incident notification follows within 72 hours. A final report is due not later than one month after that notification.

A trust service provider, for a significant incident that affects its trust services, notifies within 24 hours instead of the 72-hour notification. If the incident is still going when the final report is due, the entity sends a progress report then, and a final report within one month of handling the incident.