NIS2 Incident Reporting: 24 h, 72 h and 1 Month Deadlines

Under § 32 BSIG, significant security incidents must be reported without undue delay: an early warning within 24 hours and an incident report within 72 hours of awareness. The final report is due within one month of submitting the incident report. These are maximum deadlines, not waiting periods. The other NIS2 duties are covered in the NIS2 guide for SMBs.

Who has to report

Essential and important entities under § 28 BSIG. Whether you are one is covered in the NIS2 scope check. Some sectors have their own regime: for public telecommunications providers, energy operators under the German Energy Industry Act and financial entities under DORA, § 32 BSIG does not apply (§ 28(5) and (6) BSIG); they report under their own rules. Breaches of the reporting duty can be fined up to EUR 10 million for essential and EUR 7 million for important entities (§ 65 BSIG).

What counts as a significant security incident

Only significant incidents must be reported. Under § 2 BSIG, a security incident is significant if it

• has caused or can cause severe operational disruption of the services or financial losses for the entity, or
• has affected or can affect other natural or legal persons by causing considerable material or non-material damage.

Note the word "can": an incident that has not yet caused damage can still be significant. According to the BSI, this means the impact could realistically occur or can concretely be expected. For certain digital providers, including cloud computing, data centre and content delivery network providers, managed service and managed security service providers and DNS service providers, the EU Implementing Regulation 2024/2690 sets out concrete criteria.

For everyone else, the assessment remains a judgement call. These questions help to make it quickly and consistently:

• Is a service you provide to customers unavailable or noticeably degraded? For how long, and for how many customers?
• Has data left the company, or has it been altered or encrypted?
• Has an attacker gained access to systems with administrative rights?
• Can customers, patients or partners suffer damage as a result?
• Is the financial loss significant compared with the size of the company?

If the answer to one of these questions is yes, treat the incident as potentially significant and prepare the early warning. Record the facts available, your assessment and the time of awareness. These questions support the assessment; they are not legal thresholds.

The deadlines and what each report contains

§ 32(1) BSIG sets a reporting sequence. The deadlines run from becoming aware of the significant incident, not from when it began:

If the incident is still ongoing when the final report is due, you submit a progress report instead (§ 32(2) BSIG), and the final report follows once the incident has been handled.

The deadlines are counted in hours and do not pause at weekends or on public holidays. Example: your entity becomes aware of a significant incident on Friday, 6 November 2026, at 16:00. The early warning is due by Saturday at 16:00 and the incident report by Monday, 9 November, at 16:00. If you submit the incident report on 9 November, the final report is due by 9 December.

The BSI follows the principle "speed before completeness": the early warning only needs the essentials. Plan the assessment ("is this significant?") for the first hours, so that there is enough time left for the early warning once it is confirmed.

How reporting works

Reports go through the BSI portal (portal.bsi.bund.de), which is also used for registration under § 33 BSIG. Operators of critical installations and federal authorities may continue to use the BSI's reporting and information portal (MIP) for a transition period; the same report does not also have to be submitted in the BSI portal. Three things need to be settled before the first incident:

• Who decides that an incident is significant. Usually the information security officer together with management.
• Who reports. At least two people with portal access, so that holidays, illness and weekends are covered.
• What is reported. A prepared template with the information for the early warning and the incident report saves the most time when it counts.

NIS2 report and GDPR notification are separate

If personal data is affected, Article 33 GDPR also requires a notification to the competent data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the people affected. The two reports go to different authorities, have different criteria and do not replace each other. Your incident procedure should check both.

Preparation checklist

1. Write down your criteria for "significant" (the questions above are a starting point).
2. Name the decision-maker, the reporters and their deputies.
3. Check portal access for at least two people.
4. Prepare templates for the early warning and the incident report.
5. Agree by contract how fast your IT service providers inform you, including at weekends: the deadline starts with your awareness.
6. Add the GDPR check to the same procedure.
7. Run through a scenario once a year and record the result.

Documenting incidents in Valiido

In Valiido, an incident holds the description, affected systems, measures and lessons learned. Enter the date and time you became aware of it, and Valiido shows the deadlines for the early warning and the incident report; the one-month deadline for the final report starts from the date you record for the submitted incident report. Each stage has a status: open, done or overdue. You submit the reports yourself in the BSI portal. See Valiido for NIS2.

Incident handling itself is one of the ten areas of measures under § 30(2) BSIG, covered in the ten NIS2 measures; management's role is covered in NIS2 management training.

Frequently Asked Questions

When exactly does the 24-hour deadline start?

According to the BSI, when an employee of your entity becomes aware of a significant security incident during working hours. Not when the incident began, and not with every alert that is still being checked.

Do we need a complete forensic analysis before the early warning?

No. Report what is known and mark what is still unclear; update it in the incident report. If in doubt, the BSI says containing the acute impact comes before reporting.

What additional information must operators of critical installations report?

Under § 32(3) BSIG, if the incident affects or could affect a critical installation, include its type, the critical service and the impact on that service.