European UnionNIS2 Directive, Reporting Obligations
Directive (EU) 2022/2555, Art. 23
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This duty reaches your service where you operate an online marketplace, online search engine or social networking services platform under Annex II and you qualify as a medium-sized enterprise or larger under the EU size-cap rule, or regardless of size where Article 2(2), points (b) to (e), applies, for example where you are the sole provider in a Member State of a service essential for the maintenance of critical societal or economic activities. It also reaches you where you are a public administration entity of central government, or a regional one that, following a risk-based assessment by the Member State, provides services whose disruption could have a significant impact on critical societal or economic activities (Annex I and Article 2(2), point (f)), unless your activities are in the areas of national security, public security, defence or law enforcement (Article 2(7)).
- Notify your computer security incident response team (CSIRT), or the competent authority where applicable, of any incident with a significant impact on the provision of your services: an early warning within 24 hours of becoming aware, an incident notification within 72 hours of becoming aware (24 hours if you are a trust service provider), an intermediate report on relevant status updates if your CSIRT or competent authority asks for one, and a final report no later than one month after the incident notification, or, for an incident still ongoing at that point, a progress report then and a final report within one month of its handling.NIST CSF 2.0RS.CO-02
- Where appropriate, notify, without undue delay, the recipients of your services who a significant incident is likely to adversely affect, and communicate to recipients potentially affected by a significant cyber threat any measures or remedies they can take.NIST CSF 2.0RS.CO-02
- Treat an incident as significant where it has caused or is capable of causing severe operational disruption or financial loss to your own operations, or considerable material or non-material damage to another person.
- Where you are one of the providers Commission Implementing Regulation (EU) 2024/2690 names, apply the significance criteria of its Articles 3 to 14 to decide which incidents to notify, which its recital 30 treats as exhaustive.NIST CSF 2.0RS.MA-03
These lines are LexLint's reading of the law's text. Also read by: European Commission, on behalf of the NIS Cooperation Group (EU Member States, the European Commission and ENISA) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 34(4): where a Member State's transposing law is infringed as to Article 23 (or Article 21), an essential entity is subject to an administrative fine of a maximum of at least EUR 10,000,000 or at least 2 percent of total worldwide annual turnover, whichever is higher. Article 34(5) sets a lower tier for an important entity, a maximum of at least EUR 7,000,000 or at least 1.4 percent of turnover, whichever is higher. This is a directive: the figures are the floor each Member State's own transposing law must set as its statutory maximum, not a cap the Union applies directly.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The competent authority designated or established by each EU Member State under Article 8 of the Directive, which supervises compliance and applies the Chapter VII enforcement measures, with Article 23 notifications received by the CSIRT designated under Article 10 or, where applicable, by the competent authority, and coordination at Union level through the NIS Cooperation Group and the CSIRTs network.
Enforcement record
Article 23 is enforced by each Member State's own competent authority under the same Chapter VII (Arts. 31 to 37) supervisory and enforcement measures that apply to Article 21. The European Commission's own NIS2 policy page describes the Directive as calling on Member States to define national cybersecurity strategies and collaborate with the EU for cross-border reaction and enforcement, and names the NIS Cooperation Group, the one standing body bringing together Member States, the Commission and ENISA on NIS2 implementation, as an issuer of non-binding guidelines and recommendations. No count, fine total or median penalty for action taken under Article 23 is published on that page.
- As of
- Source link
- https://digital-strategy.ec.europa.eu/en/policies/nis2-directive
Settledness
The NIS Cooperation Group adopted common notification templates for Article 23 reporting on and the Commission plans to make them mandatory across Member States through an implementing act; no court has construed the reporting duty and none of it is under challenge as of the date shown.
- As of
- Guidance link
- https://digital-strategy.ec.europa.eu/en/news/nis2-cooperation-group-adopts-common-templates-incident-reporting
- Guidance body
- European Commission, on behalf of the NIS Cooperation Group (EU Member States, the European Commission and ENISA)
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32022l2555
What this law does
Article 23 requires each Member State to ensure that an essential or important entity notifies its computer security incident response team (CSIRT), or the competent authority where applicable, of any incident that has a significant impact on the provision of its services, on a staged clock: an early warning within 24 hours of becoming aware of the significant incident, an incident notification within 72 hours of becoming aware (24 hours for a trust service provider), an intermediate report on relevant status updates when its CSIRT or competent authority asks for one, and a final report no later than one month after the incident notification, or, for an incident still ongoing at that point, a progress report then and a final report within one month of its handling.
Where appropriate, the entity must also notify, without undue delay, the recipients of its services that a significant incident is likely to adversely affect, and must communicate to service recipients potentially affected by a significant cyber threat any measures or remedies they can take. An incident is significant where it has caused or is capable of causing severe operational disruption or financial loss to the entity, or considerable material or non-material damage to another person.
For the DNS, top-level domain (TLD), cloud, data centre, content delivery network, managed service, managed security service, online marketplace, online search engine, social networking and trust service providers that Commission Implementing Regulation (EU) 2024/2690 names, Articles 3 to 14 of that Regulation specify the cases in which an incident is significant, and its recital 30 states that those criteria should be considered exhaustive, without prejudice to Article 5 of the Directive.
When LexLint raises it
When your app profile says your app operates a social platform or runs an essential service.
Back to the example · Lint your app
Page updated .