Start with your country’s official cyber-incident channel. Use the European Union Agency for Cybersecurity (ENISA) map of national reporting mechanisms to identify the responsible CSIRT (computer security incident response team), competent cybersecurity authority or sector regulator, then follow that authority’s current instructions. If your organisation is covered by the NIS2 Directive and the event is a significant incident, an early warning is due without undue delay and within 24 hours of awareness, followed by a fuller notification within 72 hours. A personal-data breach, regulated-sector event, suspected crime or product-security issue can create separate filings. A report to one authority does not automatically satisfy every other obligation.
What to do first
Do not wait for a complete forensic investigation before making a legally required initial notification. Stabilise affected systems, preserve evidence, identify the correct national entry point and record when the organisation became aware of the incident. Use a published secure channel from the authority, not an unverified email address found in a forum or social-media post.
As an Amazon Associate I earn from qualifying purchases.
- Record the awareness time. Note when an authorised person first had enough information to recognise a potentially significant incident. This timestamp is important for any statutory clock.
- Contain without destroying evidence. Isolate compromised accounts, hosts or network segments according to your incident plan. Preserve logs, volatile data where feasible, ransom notes, malware samples, access records and relevant communications.
- Find the national route. ENISA’s “Incident Reporting Mechanisms” map links to each country’s CSIRT, competent authority and national procedures. The linked authority’s current page controls the practical submission method.
- Run a parallel-obligation check. Ask whether NIS2, data-protection, financial, telecom, product-security or criminal-reporting rules apply. Assign an owner and deadline to each route.
- Send an initial report with known facts. Mark unknown fields as under investigation, explain what is being done to verify them, and ask whether the authority wants staged updates.
Find the correct national authority
For a general cyber incident in the EU, the national CSIRT or cybersecurity agency is the sensible starting point, but eligibility and support differ by country. ENISA’s country map is an orientation tool, not a single EU-wide mailbox. Confirm that the linked procedure covers your country, organisation type and incident.
Examples of national arrangements
- Belgium: ENISA identifies the Centre for Cybersecurity Belgium and its Safeonweb route. Check whether the page is intended for your organisation or for public advice.
- Estonia: CERT-EE provides a national reporting environment. Follow its current authentication and technical-submission requirements.
- Finland: the National Cyber Security Centre Finland accepts reports through an online form or email, subject to the instructions in force when you file.
- Germany: the Federal Office for Information Security (BSI) provides a portal for entities that fall within its reporting remit. Other organisations may have a different route.
- Ireland: the National Cyber Security Centre gives a contact route for incidents of national concern. It is not necessarily the recipient for every private-sector event.
- Spain: INCIBE-CERT serves citizens and private-law entities, while public-sector bodies use the separate CCN-CERT arrangements described by ENISA.
These examples illustrate why copying another country’s form can misdirect a report. A multinational group may need to notify more than one national authority when entities, services or effects span jurisdictions.
When NIS2 reporting applies
NIS2 reporting duties attach to in-scope “essential” and “important” entities, as implemented in the relevant Member State, when they experience a significant incident. They do not automatically apply to every citizen, freelancer, small business or cyber event. Determine your entity’s classification, sector, national implementing law and any special regime before deciding that NIS2 is or is not triggered.
What counts as a significant incident
Article 23 of the NIS2 Directive describes an incident as significant when it has caused, or is capable of causing, severe operational disruption or financial loss to the entity, or when it has affected, or is capable of affecting, others by causing considerable material or non-material damage. The practical threshold and evidence expected are worked out through national procedures. Do not reduce the test to “report every attack” or to a single number of affected devices.
The staged NIS2 timeline
| Stage | Deadline | What to include | Qualification |
|---|---|---|---|
| Early warning | Without undue delay and no later than 24 hours after awareness of the significant incident | State that a significant incident has occurred; where applicable, indicate suspected unlawful or malicious cause and possible cross-border impact. | European Union, NIS2 Directive Article 23 (2022). National instructions determine the channel and required fields. |
| Incident notification | Without undue delay and no later than 72 hours after awareness | Update the early warning; provide an initial severity and impact assessment and indicators of compromise, if available. | This is an initial assessment, not a demand for completed forensics. |
| Final report | Follow the sequence and timing specified by Article 23 and the implementing national authority | Provide the final analysis, response and recovery information requested by the authority. | Do not assume that the 24-hour and 72-hour notices are the only report a national procedure may require. |
The 24-hour and 72-hour periods are legal deadlines, not targets that replace immediate action. If a fact is unknown, say so, give the best supported preliminary assessment and update it. Keep the time of awareness, submission receipts and every subsequent update.
Recommended Free Tools
Check for reports that run in parallel
A single cyberattack can activate several legal regimes. NIS2 anticipates cooperation among CSIRTs, competent authorities, law enforcement, data-protection authorities and sector bodies, but cooperation does not create one universal filing. Verify each trigger, recipient, deadline and form separately.
Rank #2
| Situation | Likely recipient | Questions to answer |
|---|---|---|
| Significant incident at an in-scope essential or important entity | National CSIRT or NIS2 competent authority | Is the entity in scope under national law? Is the incident significant? Which staged notices and final report are required? |
| Personal data was destroyed, lost, altered, disclosed or accessed unlawfully | The competent data-protection supervisory authority; affected individuals may also need notification | Does the controller’s data-breach threshold apply? What is the supervisory authority’s deadline and form? Are processor and controller responsibilities documented? |
| Payment, banking, insurance, investment or another regulated financial service is affected | The applicable financial-sector authority, in addition to any cyber authority | Does a sector incident rule use a different severity test, clock or template? |
| Electronic communications or telecom service is affected | The national communications regulator or designated sector body | Does the service-specific incident regime require an outage, security or customer-impact notice? |
| A crime is suspected, such as extortion, fraud, unauthorised access or theft | Police or another national law-enforcement channel | How can evidence be submitted safely, and who preserves chain of custody? Does the authority provide an emergency contact? |
| A manufacturer’s product with digital elements has an exploited vulnerability or severe security incident | Cyber Resilience Act Single Reporting Platform, with the relevant CSIRT identified under the CRA | Is the filer the manufacturer or open-source software steward covered by the CRA, rather than a customer or victim organisation? |
When two rules appear to overlap, notify the authority whose deadline arrives first while confirming the other route. Ask each recipient whether it will coordinate with another body; never infer that coordination eliminates your separate duty.
Prepare an initial report that authorities can use
A short, accurate first report is more useful than a long document filled with guesses. NIS2 Article 23 calls for an account of the incident, suspected malicious or unlawful cause where relevant, possible cross-border impact, an initial severity and impact assessment, and indicators of compromise when available. National portals can request additional technical material.
Incident identity and timing
- Organisation name, legal entity, sector, countries affected and a 24-hour contact with authority to answer questions.
- Date and time of the first suspected activity, detection, containment and organisational awareness, with the time zone for each.
- Systems, services, facilities or suppliers involved, and whether operations are continuing, degraded or stopped.
Impact and cause
- What happened in plain language: for example, ransomware encryption, credential compromise, denial of service, data exfiltration or exploitation of a vulnerability.
- Current and potential operational, financial, safety, customer and third-party effects. Distinguish confirmed impact from a credible possibility.
- Any indication of unlawful or malicious intent, suspected actor or technique, clearly labelled as an assessment rather than a proven attribution.
- Whether effects cross a national border or involve services supplied to other entities.
Technical indicators and response
- Malicious domains, IP addresses, file hashes, email headers, user accounts, timestamps, affected versions and other indicators of compromise, if validated and safe to share.
- Containment and recovery steps already taken, such as account resets, isolation, restoration from clean backups or engagement of an incident-response provider.
- Known dependencies, vendors or processors that may have to report the same event under their own obligations.
- What remains unknown, who is investigating it and when the next update will be provided.
Use the authority’s secure upload facility for sensitive logs and personal data. Do not attach more personal information than necessary. Keep an immutable copy of the submitted report, attachments, portal confirmation and correspondence.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat to do after submitting
Maintain an evidence and decision log
Record each decision, including why a system was isolated, who approved a shutdown, when a regulator was contacted and what facts supported the severity assessment. Preserve original files and calculate hashes for exported evidence where your process supports it. Avoid wiping compromised devices solely to make them usable again unless safety or business continuity requires it and the preservation step is documented.
Rank #3
Send controlled updates
Use the same case number and contact wherever possible. Separate newly confirmed facts, revised estimates and unresolved hypotheses. If the authority requests a different format, follow it even when your internal report uses another structure. Coordinate public statements with legal, communications and affected suppliers so that a press release does not disclose investigative material or contradict a regulatory filing.
Coordinate without assuming confidentiality
Ask how the recipient handles commercially sensitive information, personal data and law-enforcement requests. Share only what is necessary through the approved channel, while retaining enough detail to satisfy a later audit or investigation.
The Cyber Resilience Act route is limited
The European Commission says the Cyber Resilience Act (CRA) Single Reporting Platform became operational on 11 September 2026. It is intended for manufacturers and open-source software stewards reporting certain actively exploited vulnerabilities and severe incidents affecting products with digital elements. The Commission describes an early warning within 24 hours, a full notification within 72 hours and a later final report under the applicable CRA timing. The initial CSIRT is associated with the manufacturer’s main establishment, and information is ordinarily made available to ENISA.
Free tools Windows power users keep installed
One-click scans. No signup required.
This platform is not a general victim-reporting portal. A company whose network was attacked by a vulnerable product does not become a CRA manufacturer merely because it uses that product. The customer may still have NIS2, data-protection, sector or crime-reporting duties. A manufacturer may have CRA duties as well as obligations under other laws; one submission does not replace the others.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A practical decision framework
Use this sequence for an incident-room triage call:
- Where is the affected entity established and where are the services delivered? List every Member State with a potentially relevant entity, operation or authority.
- What is the organisation’s legal and sector status? Check NIS2 essential/important classification and any financial, telecom, health, transport, energy or other sector regime in national law.
- What is the incident’s present and potential impact? Apply the national significance test; do not wait for final attribution.
- Did personal data, a regulated service or a product with digital elements feature? Open a separate workstream for each applicable authority.
- Is a crime suspected? Preserve evidence and use the national police or law-enforcement route in parallel.
- Which deadline comes first? Build a timeline from the awareness time, with named owners, approval points and reminders for every update.
- What can be safely stated now? Submit verified facts, clearly mark uncertainty and schedule the next update rather than delaying a required notice.
Common reporting mistakes
Using ENISA as the direct recipient
ENISA provides European guidance and the national-mechanism map. It is not normally the direct recipient of an organisation’s NIS2 incident notification. File with the national CSIRT or competent authority identified for your case.
Assuming every attack is a NIS2 event
NIS2 scope and the significant-incident threshold matter. A non-covered individual or organisation may still need to report a data breach, crime or sector incident, but should not claim a NIS2 filing is mandatory without checking national law.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWaiting for perfect attribution
Authorities need timely situational awareness. Suspected cause and indicators can be supplied with confidence labels; attribution can be refined in later reports.
Best Value
Filing once and closing the case
Early warning, incident notification, final reporting and parallel regulator notices are distinct steps. Keep the case open until every required update is accepted or the authority confirms closure.
Copying a foreign form
National portals, languages, authentication methods, thresholds and sector contacts differ. Use the ENISA map only to locate the official page, then follow that page’s current instructions.
Over-sharing sensitive material
Send technical evidence through the authority’s secure channel and limit personal data to what is necessary. An ordinary email attachment can expose victims and compromise an investigation.
Where to verify the current rule
Use three official reference points: NIS2 Directive Article 23 for the staged significant-incident notification duty and Article 13 for cooperation; ENISA’s “Threats and Incidents” overview for EU-level explanations and sector distinctions; and ENISA’s “Incident Reporting Mechanisms” map for country channels. For product manufacturers, consult the European Commission’s CRA reporting-obligations guidance, updated 11 September 2026. National implementing legislation and the authority’s latest portal instructions control practical filing details.
ENISA describes incident reporting as essential for understanding and analysing the EU cybersecurity threat landscape. Its 2024 telecom security incident summary contained 188 incidents submitted by national authorities from 26 EU Member States and two EFTA countries (ENISA, 2025). That figure is a telecom reporting summary, not a count of all EU cyberattacks and not a measure of whether your own event must be reported.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
