Law / Frameworks / ENISA NIS2 guidance / Incident handling

ENISA NIS2 guidance 3.4Event assessment and classification

The relevant entities shall assess suspicious events to determine whether they constitute incidents and, if so, determine their nature and severity.ENISA NIS2 Technical Implementation Guidance, version 1.0, June 2025, with mapping table version 1.2, 3.4

We read each law below as bearing on this requirement. That does not mean the requirement, done well, meets the law: what each law asks is on its own page. Law library as of 19 Oct 2026.

The kinds of duty that reach it: breach notice, reporting.

108: laws
69: jurisdictions
0: with court rulings behind them
5: not yet in force
5: proposed, not law

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST Privacy FrameworkCM.AW-P7 Impacted individuals and organizations are notified about a privacy breach or event., 36 laws
NIST Privacy FrameworkPR.PO-P7 Response plans (Incident Response and Business Continuity) and recovery..., 11 laws
NIST Privacy FrameworkPR.PO-P10 A vulnerability management plan is developed and implemented., 2 laws
NIST CSF 2.0RS.CO-02 Internal and external stakeholders are notified of incidents, 98 laws
NIST CSF 2.0RS.CO-03 Information is shared with designated internal and external stakeholders, 49 laws
NIST CSF 2.0GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity -..., 23 laws
7 more in the NIST CSF 2.0
FINOS AIGFAIR-DET-004 AI System Observability, 108 laws
FINOS AIGFAIR-DET-021 Agent Decision Audit and Explainability, 107 laws
FINOS AIGFAIR-PREV-005 System Acceptance Testing, 15 laws
10 more in the FINOS AIGF

A law in force is unmarked; the rest wear their state: not yet in force proposed

Vulnerability and incident reporting

86 laws, 63 jurisdictions

Jurisdiction	Law	How it reaches this requirement
Andorra	Llei 22/2022, Incident Handling and Notification Obligation	Through its reporting duty. What it requires
Angola	Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties	Through its reporting duty. What it requires
Austria	Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Bangladesh	Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident	Through its reporting duty. What it requires
Belgium	Loi du 26 avril 2024, Significant-Incident Notification Obligations	Through its reporting duty. What it requires
Bulgaria	Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS)	Through its reporting duty. What it requires
China	Data Security Law, Risk Monitoring and Incident Reporting Duty	Through its reporting duty. What it requires
China	National Cybersecurity Incident Reporting Measures	Through its reporting duty. What it requires
Croatia	Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations	Through its reporting duty. What it requires
Cuba	Resolución 105/2021, Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de Ciberseguridad	Through its reporting duty. What it requires

Show the other 76 laws

Cyprus	Security of Networks and Information Systems Law, Incident Notification Obligations	Through its reporting duty. What it requires
Czech Republic	Cybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification	Through its reporting duty. What it requires
Côte d'Ivoire	Mandatory Reporting of Attacks and Intrusions to ARTCI	Through its reporting duty. What it requires
Democratic Republic of the Congo	Digital Code, Livre II: Trust Service Provider Security-Incident Notification	Through its reporting duty. What it requires
Democratic Republic of the Congo	Digital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty	Through its reporting duty. What it requires
Denmark	NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties	Through its reporting duty. What it requires
Djibouti	Digital Code, Book VII: National Health Data System Security Incident Reporting	Through its reporting duty. What it requires
Estonia	Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident	Through its reporting duty. What it requires
Ethiopia	Computer Crime Proclamation, Duty to Report Computer Crime and Illegal Content	Through its reporting duty. What it requires
Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT from 21 Jul 2027, in 9 months	Through its reporting duty. What it requires
European Union	Commission Delegated Regulation (EU) 2022/1645, External Reporting of Information Security Incidents and Vulnerabilities (IS.D.OR.230)	Through its reporting duty. What it requires
European Union	Commission Delegated Regulation (EU) 2024/1366, Cybersecurity Network Code for Cross-Border Electricity Flows: Information Sharing on Cyber-Attacks and Threats	Through its reporting duty. What it requires
European Union	Commission Implementing Regulation (EU) 2023/203, External Reporting of Information Security Incidents and Vulnerabilities in Aviation (IS.I.OR.230)	Through its reporting duty. What it requires
European Union	Cyber Resilience Act, Manufacturer Reporting Obligations	Through its reporting duty. What it requires
European Union	DORA Technical Standards on the Standard Forms, Templates and Procedures for Reporting Major ICT-Related Incidents and Notifying Significant Cyber Threats	Through its reporting duty. What it requires
European Union	DORA, Article 19 (reporting of major ICT-related incidents), with the time limits of Delegated Regulation (EU) 2025/301	Through its reporting duty. What it requires
European Union	eIDAS Regulation, Article 19a(1)(b): Notification of Security Breaches and Disruptions by Non-Qualified Trust Service Providers	Through its reporting duty. What it requires
European Union	EUCC Certification Scheme, Vulnerability Impact Analysis Report and Disclosure	Through its reporting duty. What it requires
European Union	European Health Data Space Regulation, Serious-Incident Reporting by Manufacturers of EHR Systems from 26 Mar 2029, in 2.4 years	Through its reporting duty. What it requires
European Union	NIS2 Directive, Reporting Obligations	Through its reporting duty. What it requires
Finland	Kyberturvallisuuslaki, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Finland	Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Reporting of Deviations in Information Systems and Wellbeing Applications and of Significant Information Security Disturbances	Through its reporting duty. What it requires
Finland	Laki sähköisen viestinnän palveluista, Security Incident Notices by Telecommunications Operators	Through its reporting duty. What it requires
France	Loi n° 2018-133 du 26 février 2018 (transposition NIS1), Incident Notification	Through its reporting duty. What it requires
France	Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Incident Notification (NIS2) proposed	Through its reporting duty. What it requires
Gambia	Information and Communications Act, 2009, security of information and communications services (subscriber risk notification)	Through its breach notice duty. What it requires
Germany	BSI-Gesetz (BSIG), Incident Notification	Through its reporting duty. What it requires
Ghana	Cybersecurity Act, Duty to Report Cybersecurity Incident	Through its reporting duty. What it requires
Greece	Law 5160/2024, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Hungary	Cybersecurity Act, Incident Notification and Cybersecurity Fine	Through its reporting duty. What it requires
Iceland	Notification of Serious Incidents and Risk to the National Cybersecurity Incident-Response Team	Through its reporting duty. What it requires
India	CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation	Through its reporting duty. What it requires
Indonesia	Government Regulation on the Operation of Electronic Systems and Transactions, security-incident reporting duty	Through its reporting duty. What it requires
Ireland	European Union (NIS) Regulations 2018, Incident Notification	Through its reporting duty. What it requires
Ireland	National Cyber Security Bill, Incident Response Powers and Reporting Obligations proposed	Through its reporting duty. What it requires
Italy	Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Incident Notification	Through its reporting duty. What it requires
Italy	Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties	Through its reporting duty. What it requires
Jordan	Cyber Security Law No. 16 of 2019, Article 8 private-sector incident-reporting and Center-cooperation duty	Through its reporting duty. What it requires
Kenya	Computer Misuse and Cybercrimes Act, Reporting of Cyber Threat	Through its reporting duty. What it requires
Kiribati	Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident from a date not yet set	Through its reporting duty. What it requires
Kyrgyzstan	Digital Code, digital resilience incident notification	Through its reporting duty. What it requires
Latvia	Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation	Through its reporting duty. What it requires
Latvia	Nacionālās kiberdrošības likums, Incident Notification	Through its reporting duty. What it requires
Liechtenstein	Cyber-Sicherheitsgesetz (CSG), Incident Notification	Through its reporting duty. What it requires
Lithuania	Kibernetinio saugumo įstatymas (Law on Cyber Security), Incident Notification	Through its reporting duty. What it requires
Luxembourg	Loi du 20 décembre 2024, Cybersecurity Certification Authority and Vulnerability Notices	Through its reporting duty. What it requires
Luxembourg	Loi du 5 mai 2026 relative à la cybersécurité (NIS2), Incident Notification	Through its reporting duty. What it requires
Malta	Electronic Communications Networks and Services (General) Regulations, Security Incident Notification to the Malta Communications Authority	Through its reporting duty. What it requires
Malta	Gaming Authorisations and Compliance Directive, Notification of Information Security Breaches	Through its reporting duty. What it requires
Malta	Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Significant-Incident Reporting to the National CSIRT	Through its reporting duty. What it requires
Marshall Islands	Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations	Through its reporting duty. What it requires
Mongolia	Law on Cyber Security, Cyber-Attack Notification Duty for Other Legal Persons	Through its reporting duty. What it requires
Montenegro	Law on Information Security, Cyber Threat and Incident Reporting	Through its reporting duty. What it requires
Morocco	Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Incident and Vulnerability Notification Duties	Through its reporting duty. What it requires
Mozambique	Cybersecurity Law, Incident Notification and Responsible Vulnerability Disclosure	Through its reporting duty. What it requires
Netherlands	Cyberbeveiligingswet, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
New York	New York Department of Financial Services Cybersecurity Regulation, Notices to the Superintendent	Through its reporting duty. What it requires
Nigeria	Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, as amended in 2024, Reporting of Cyber Threats to the National CERT	Through its reporting duty. What it requires
Poland	Ustawa o krajowym systemie cyberbezpieczeństwa (KSC), Zgłaszanie Incydentów Poważnych	Through its reporting duty. What it requires
Portugal	Regime Jurídico da Cibersegurança, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Romania	Ordonanța de urgență nr. 155/2024, Incident Notification	Through its reporting duty. What it requires
Serbia	Law on Information Security, Incident Reporting Obligations	Through its reporting duty. What it requires
Sierra Leone	Cyber Security and Crime Act, 2021, Reporting of Cyber Security Incidents	Through its reporting duty. What it requires
Slovakia	Vyhláška NBÚ č. 226/2025 Z. z., Details of Cyber Security Reports	Through its reporting duty. What it requires
Slovakia	Zákon o kybernetickej bezpečnosti (Cybersecurity Act), Incident and Vulnerability Notification	Through its reporting duty. What it requires
Slovenia	Zakon o informacijski varnosti (ZInfV-1), Significant-Incident Notification Obligations	Through its reporting duty. What it requires
South Korea	Information and Communications Network Act, Report on Computer Security Incidents	Through its reporting duty. What it requires
Spain	Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, Incident Reporting Obligations proposed	Through its reporting duty. What it requires
Spain	Real Decreto-ley 12/2018, Incident Notification Obligation	Through its reporting duty. What it requires
Sweden	Cybersäkerhetslag, Incident Notification	Through its reporting duty. What it requires
Taiwan	Cyber Security Management Act, Cyber Security Incident Reporting	Through its reporting duty. What it requires
Tonga	Cybersecurity Act 2025, Duty to Report a Cybersecurity Incident from a date not yet set	Through its reporting duty. What it requires
Tunisia	Cybersecurity Incident Reporting and Emergency Response	Through its reporting duty. What it requires
Turkey	Cybersecurity Law, Reporting and Cooperation Duties	Through its reporting duty. What it requires
Ukraine	Law on the Basic Principles of Ensuring Cybersecurity, CERT-UA Incident Notification Duty	Through its reporting duty. What it requires
Vietnam	Cybersecurity Law, Incident Response and Reporting Duties	Through its reporting duty. What it requires

Sector security regimes

20 laws, 20 jurisdictions

Jurisdiction	Law	How it reaches this requirement
Albania	Law No. 25/2024, On Cybersecurity	Through its reporting duty. What it requires
Canada	OSFI Guideline B-10, Third-Party Risk Management	Through its reporting duty. What it requires
Central African Republic	Cybersecurity Law: Mandatory Security Audit Regime	Through its reporting duty. What it requires
Croatia	Zakon o provedbi Uredbe (EU) 2022/2554, Competent Authorities, Incident Reporting and Fines for Financial Entities	Through its reporting duty. What it requires
Djibouti	Digital Code, Book II: Electronic Communications Network and Service Security	Through its reporting duty. What it requires
European Union	DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers)	Through its reporting duty. What it requires
Finland	Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars	Through its reporting duty. What it requires
Italy	Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification	Through its reporting duty. What it requires
Latvia	Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements	Through its reporting duty. What it requires
Lebanon	Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts)	Through its reporting duty. What it requires

Show the other 10 laws

Malta	Malta DORA Regulations (S.L. 330.20)	Through its reporting duty. What it requires
Netherlands	Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details	Through its reporting duty. What it requires
Poland	Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions	Through its reporting duty. What it requires
Portugal	Lei n.º 73/2025, Digital Operational Resilience of the Financial Sector	Through its reporting duty. What it requires
Romania	DNSC Order 1/2025, Notification for Registration of Essential and Important Entities	Through its reporting duty. What it requires
Somalia	Somalia Cybersecurity Act (2026) proposed	Through its reporting duty. What it requires
Sweden	Cybersäkerhetsförordning (2025:1507), Notification Channels and Supervisory Authorities	Through its reporting duty. What it requires
Taiwan	Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit	Through its reporting duty. What it requires
Tonga	Cybersecurity Act 2025, Critical Infrastructure Operator Obligations from a date not yet set	Through its reporting duty. What it requires
United Kingdom	Cyber Security and Resilience (Network and Information Systems) Bill proposed	Through its reporting duty. What it requires

Product security requirements

2 laws, 2 jurisdictions

Jurisdiction	Law	How it reaches this requirement
China	Cybersecurity Law, Network Product and Service Security Duties	Through its reporting duty. What it requires
Finland	Kyberkestävyyslaki, National Enforcement and Market Surveillance for the Cyber Resilience Act	Through its reporting duty. What it requires

Section titles and the first point of each of the ENISA NIS2 Technical Implementation Guidance, CC BY 4.0. ENISA Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, version 1.0 (June 2025), © European Union Agency for Cybersecurity (ENISA), 2025, licensed under CC BY 4.0. The section titles and requirement text are the Annex to Implementing Regulation (EU) 2024/2690 as ENISA prints it (© European Union); each section carries its first point as its text, and ENISA's guidance, examples of evidence and tips are not reproduced. Every requirement of the framework.