Article 23

Without undue delay and in any event within 24 hours of becoming aware of the significant incident, the entity sends an early warning. Where applicable, the warning indicates whether the incident is suspected of being caused by unlawful or malicious acts, or could have a cross-border impact.

Without undue delay and in any event within 72 hours, the entity sends an incident notification. It updates the early warning and gives an initial assessment of the incident, including its severity and impact, and indicators of compromise where available.

A final report follows not later than one month after the incident notification. If the incident is still ongoing at that point, the entity provides a progress report then, and a final report within one month of handling the incident.

A trust service provider, for significant incidents that affect the provision of its trust services, notifies the CSIRT or the competent authority within 24 hours of becoming aware. That is a derogation from the 72-hour notification.

The CSIRT or the competent authority shall provide, without undue delay and where possible within 24 hours of receiving the early warning, a response to the notifying entity, including initial feedback and, on request, guidance on mitigation.