Short answer
24 hours: early warning. 72 hours: incident notification. One month: final report. The clock starts when you become aware of a significant incident. Do not wait for a complete root-cause analysis before sending the early warning; refine it later.
Timeline
| Stage | Deadline | Purpose |
|---|---|---|
| Early warning | 24 hours | Alert the authority and CSIRT; initial impact and contact. |
| Notification | 72 hours | Assess severity, affected services and initial response. |
| Final report | 1 month | Root cause, impact, measures and lessons. |
Keep a dated log of detection, decisions and submissions. The timeline is evidence too.
What to include
- Entity: legal name, contact and affected services.
- Incident: what happened, detection time and initial cause.
- Impact: operational, financial, customer and cross-border effects.
- Response: containment, workarounds and current status.
- Contact: a person who can answer follow-up questions.
Send what you know, mark uncertainty explicitly, and correct it in the next report.
Process
- Detect and declare: name an incident lead and start the log.
- Triage: decide whether it is significant and which services are affected.
- Warn: submit the 24-hour early warning through the official channel.
- Investigate: contain, preserve evidence and prepare the 72-hour notification.
- Close: submit the final report and record corrective actions.
Run a tabletop before you need this process. See training and tabletop.
Common errors
- Waiting for a complete root cause before the 24-hour warning.
- Notifying only the IT team and not the legal/communications owners.
- No evidence preservation: logs overwritten during containment.
- Understating cross-border or supplier impact.
- No record of the submission or follow-up.
Frequently asked questions
What are the NIS2 incident reporting deadlines?
An early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours, and a final report within one month.
Who do I notify in Estonia?
Notify the competent authority and CSIRT through the channel specified by RIA. Use the current official route and keep the submission confirmation.
What is a significant incident?
An incident that causes severe operational disruption, financial loss or harm to others. The assessment is fact-specific; do not wait for perfect information before sending the early warning.
What should the early warning contain?
What happened, when it was detected, affected services, initial impact, cross-border effects and a contact. It can be refined in later reports.