NIST CSF 2.0, RespondRS.CO-03

When you submit an intermediate or a final report, use the Annex I template to submit all required information and update, where applicable, the information that you provided earlier (Article 1(4)).

If you notify a significant cyber threat to your competent authority under Article 19(2) of Regulation (EU) 2022/2554, use the template in Annex III, follow the data glossary and instructions in Annex IV, and ensure that the information is complete and accurate (Article 8).

Submit an intermediate report within 72 hours of the initial notification, and submit an updated intermediate report without undue delay and in any case when you have recovered regular activities.

Submit a final report no later than one month after the intermediate report, or your latest updated one, once you know the root cause and the actual impact figures.

Transmit the report to the certification body or the national cybersecurity certification authority, in accordance with Article 56(8) of Regulation (EU) 2019/881, without undue delay (Article 35(4)).

Upon withdrawal of the certificate, disclose and register any publicly known and remediated vulnerability in the ICT product on the European vulnerability database established under Article 12 of Directive (EU) 2022/2555, or on the other online repositories referred to in Article 55(1), point (d), of Regulation (EU) 2019/881 (Article 39).

Provide an interim report on the authority's request, or within one month of your follow-up notification if the incident is long-running, and a final report within one month of the follow-up notification, or within one month of the incident's resolution if it is still ongoing at that point, describing the incident, its likely root cause, mitigation measures taken, and any cross-border effects.

If a deviation in an information system or wellbeing application may cause a significant risk to client or patient safety or to information security, notify the Licensing and Supervisory Authority (Lupa- ja valvontavirasto); if you are a pharmacy and the deviation may put your operations at significant risk, also notify the Finnish Medicines Agency (section 90).

Submit an intermediate report on the BSI's request, and a final report within one month of the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report once you have finished handling it.

Submit an interim report if the National Cybersecurity Authority requests one.

Submit a final report no later than one month after the 72-hour notification, describing the incident in detail, its severity and effects, the likely threat or root cause, mitigating measures applied, and any cross-border impact; if the incident is still ongoing at that point, submit a progress report instead and the final report within one month of its resolution.

Submit an interim status report if the center asks for one, and, if the incident is still ongoing when the final report is due, a report on the results achieved so far followed by a final report within one month after you have finished handling the incident (Decree 418/2024, Section 77(1)).

Enable logs of all your ICT systems and retain them securely, within Indian jurisdiction, on a rolling 180-day basis, and provide them to CERT-In together with an incident report or when CERT-In orders or directs you to.

Notify the CSIRT again as soon as practicable once the incident has been resolved, and in any event not later than 72 hours after that time (Regulations 18(9) and (10), 22(10) and (11)).

Where the incident is still ongoing when the final report falls due, submit a progress report at that time and a final report within one month of handling the incident (Head 15).

Submit an intermediate report on CSIRT Italia's request, and a final report within one month of the notification (or, for an incident still ongoing at that point, a monthly progress report and a final report within one month of the incident's resolution).

Provide any further information the National CERT or a Sectoral CERT requests about the incident, and allow either CERT to access your network and information infrastructure to analyse the incident, detect other threats, identify vulnerabilities, and advise on preventative, mitigating or remedial measures.

Where you discover a vulnerability in a subject's information system or electronic communications network, report it to the competent institution within five working days; you may report anonymously and ask that your identity be kept confidential.

Within one month of the initial report, submit a final report on the incident's resolution, or, if it is still unresolved at that point, a progress report followed by a final report once you have resolved it; submit an intermediate report if the competent institution requests one.

Submit an intermediate report on the Stabsstelle Cyber-Sicherheit's request, and a final report within one month of the 72-hour notification, describing the incident's severity and impact in detail, the likely threat or root cause, and the mitigation measures taken.

If the incident is still ongoing when the final report falls due, submit a progress report at that point and a final report within one month of the incident being dealt with (Article 6(2)(e)).

If you hold a European cybersecurity certificate, issue an EU declaration of conformity, or are a conformity assessment body, inform ILNAS in writing within 72 hours of learning of a vulnerability or irregularity that may affect compliance with the security requirements linked to the certification of a product, service or process (Loi du 20 décembre 2024, Article 5(2)).

Submit an intermediate report if a CSIRT or the competent authority requests one, and a final report within one month of the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report within one month of the handling of the incident (Article 14, paragraph 4).

Where there is a particular and significant threat of a security incident, inform the users who may be potentially affected of any possible protective measures or remedies they can take and, where appropriate, of the threat itself (regulation 28(7)).

Submit an intermediate report on relevant status updates if the national CSIRT asks for one, and a final report not later than one month after the incident notification, covering a detailed description of the incident, its likely root cause, the mitigation applied and any cross-border impact; if the incident is still ongoing then, send a progress report at that point and a final report within one month of handling it.

For an ongoing significant cybersecurity incident, submit a progress report to the Secretary of Justice and the CERT-FSM within 30 days of the notification, and a final report within 30 days of the handling of the incident (Section 412(2)(d)).

For an incident the Agency rates medium, submit a first report within 72 hours of your initial notification, a further report without delay on any new development, continuing reports every 72 hours while the incident lasts, and a final report within 30 days of resolving it (Article 33).

For an incident the Agency rates high, follow the same reporting sequence on a tighter clock: continuing reports every 24 hours while the incident lasts (Article 34).

Submit an interim report if your CSIRT or competent authority asks for one.

Submit a final report no later than one month after your notification, describing the incident in detail, its severity and effects, the likely threat or root cause, mitigating measures applied, and any cross-border effects; if the incident is still ongoing at that point, submit a progress report instead and the final report within one month of resolution.

Promptly provide the Superintendent any information requested about a reported incident, and continue updating the Superintendent with material changes or new information previously unavailable; the regulation states no separate numbered clock for either duty.

Where you make an extortion payment in connection with a cybersecurity event, notify the Superintendent of the payment within 24 hours of making it, and within 30 days of the payment provide a written description of why the payment was necessary, the alternatives you considered, and the diligence you performed, including under Office of Foreign Assets Control rules.

If the handling of a significant incident has not ended when the final report falls due, submit a progress report on the handling to the competent sectoral CSIRT, and submit the final report no later than one month after the handling of the incident ends (Article 12b).

Submit a final report within 30 working days of your end-of-impact notification, describing the incident, its impact, the mitigating measures you took and any residual impact still present, and submit an interim report if the competent authority asks for one; if the incident is still ongoing when the final report falls due, submit that interim report at the authority's request every week until you submit the final report (Article 44(1) and (3)).

Report to the national cybersecurity-incident-response team any information that lets it establish a cross-border impact of the incident, without undue delay and in any event within 6 hours of becoming aware of that information (Article 15(3)).

While the incident continues, submit a status report to the single incident-reporting system every three days for a medium-level incident, or every 24 hours for a high or very high-level incident.

Submit a final report within 15 days after the incident ends, covering its type, cause, duration, scope of impact, any cross-border effect, and the steps you took to remedy it.

When you report a significant cyber threat, a near miss or a vulnerability, give the particulars of Annex 3: the type, description, possible impact and time of discovery of what you report and, for a vulnerability, the ICT product, ICT service or operational technology concerned and its manufacturer or provider where you know it.

On the CSIRT unit's request, report updated or other requested information about how the incident is progressing.

No later than one month after the 72-hour notification, report a final report describing the incident, its severity and impact, the threat type or probable root cause, the mitigating measures taken and under way, and any cross-border impact.

As drafted, the Anteproyecto would require you to submit an interim report when your reference CSIRT or the competent authority asks for one, and a final report within one month of submitting the incident notification, or, if the incident is still ongoing, a status report then and a final report within one month of the incident being handled (Article 18(6)(c) to (e)).

As drafted, the Anteproyecto would require you to communicate to the recipients of your service, as soon as possible, a significant cyberthreat that could affect them and any mitigating measures they can take.

On the authority's request, submit an interim report with relevant status updates on the significant incident.

No later than one month after your incident notification, submit a final report; if the significant incident is still ongoing at that point, submit a progress report instead and a final report within one month after you have resolved it.

Provide the Cybersecurity Directorate promptly with any data, information, document, hardware, software, or other contribution it requests in connection with its duties.

Once the final rule takes effect, promptly submit an update to a previously submitted covered cyber incident report whenever substantial new or different information becomes available or a ransom payment is later made, continuing until your organization notifies the Agency that the incident has concluded and been fully mitigated and resolved, and preserve data relevant to the incident or payment under the procedures the final rule establishes.

Submit any malicious software you isolate in connection with a reported incident to the Department of Defense Cyber Crime Center, following that Center's instructions, and never send it to the contracting officer.

If you investigate the incident yourself because you hold the resources and technical means to do so, report the results to the State Security Service.