> NIS2 incident reporting software: record security incidents, calculate the 24-hour, 72-hour and one-month deadlines automatically and evidence every notification. Source: [https://docxpert.io/en/features/nis2-incident-reporting](https://docxpert.io/en/features/nis2-incident-reporting) # NIS2 Incident Reporting Software: Never Miss a Deadline ## The NIS2 reporting cascade Article 23 of the NIS2 Directive requires essential and important entities to report significant incidents to the competent authority or CSIRT in fixed stages. The deadlines start as soon as the entity becomes aware of the incident – weekends included. | Stage | Deadline | Content | | --- | --- | --- | | Early warning | 24 hours after becoming aware | Suspected unlawful or malicious act? Possible cross-border impact? | | Incident notification | 72 hours after becoming aware | Initial assessment: severity, impact, indicators of compromise | | Intermediate report | At the authority's request | Relevant status updates | | Final report | One month after the incident notification | Detailed description, root cause, mitigation measures applied, cross-border impact | Background, criteria for significant incidents and wording tips are in our guide to [NIS2 incident reporting](https://docxpert.io/en/guides/nis2-incident-reporting). ## How docxpert supports reporting 1. 1 Record the incident Title, description, affected systems, owner and – crucially – the time of detection. You choose whether the incident falls under NIS2 or the Cyber Resilience Act. 2. 2 Deadlines are calculated From the detection time, docxpert calculates the deadlines for early warning, incident notification and final report automatically. 3. 3 Report step by step After each notification you move the status forward and record content and time of the notification. Completed steps turn green; open ones show the time remaining. 4. 4 Spot overdue items The overview counts open incidents and overdue reporting steps – so nothing gets lost between shift changes and weekends. 5. 5 Close and learn After the final report, the incident is closed. Lessons learned flow into your management system as a [corrective action](https://docxpert.io/en/features/capa-management). ## Features at a glance Automatic deadlines24 hours, 72 hours and one month for NIS2; for reports under the Cyber Resilience Act with its deadlines. Status per reporting stageOpen, early warning sent, notification sent, final report sent, closed. Key figuresNumber of incidents, open incidents and overdue reporting steps at a glance. Notes per stageWhat was reported and when? The notes serve as evidence towards authorities and auditors. OwnershipEvery incident has an owner; reporting is not tied to individual mailboxes. Audit trailStatus changes and edits are logged – traceable for later reviews. ## When is an incident significant? Not every security incident must be reported. Under Article 23(3), an incident is significant if it - has caused or is capable of causing severe operational disruption of the services or financial loss for the entity, or - has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage. Implementing acts and national rules specify these criteria for certain sectors. Define internally who assesses significance – and when in doubt, record every incident in docxpert so that the deadlines run from detection while the assessment takes place. Not legal advice docxpert supports the organisation and evidence of notifications. Whether an incident must be reported, and to whom, depends on national law and your classification. ## What good incident documentation contains Authorities expect traceable, fact-based notifications – even when much is still unclear in the first hours. For each incident, record at least the following in docxpert: - Detection time and how the incident was discovered - Affected systems, services and sites - Initial assessment of cause, severity and possible cross-border impact - Immediate actions taken and when - Content, recipient and time of every notification - Root cause, mitigation measures and lessons learned in the final report Whatever is not yet known at the time of the early warning is added in the incident notification and the final report. What matters is that every stage shows what you knew and did at that point in time. ## Be prepared before it happens The 24-hour deadline can only be met if the process has been practised. docxpert helps with preparation too: - **Reporting process as a procedure:** templates for incident management and the NIS2 reporting process in the [template library](https://docxpert.io/en/features/template-library). - **Training for those involved:** whoever reports in an emergency is trained with evidence – see [training management](https://docxpert.io/en/features/training-certification). - **Management training:** Art. 20 requires regular training for management bodies; assign it to the executive team with a deadline. - **Document exercises:** exercise incidents can be recorded and reviewed. The [NIS2 checklist](https://docxpert.io/en/checklists/nis2) gives an overview of all obligations. ## Example: suspected ransomware on a Friday evening Friday, 8:38 pm: monitoring reports unusual encryption activity on a file server. The head of IT records the incident in docxpert with detection time 8:38 pm. The early warning is therefore due by Saturday 8:38 pm, the incident notification by Monday 8:38 pm. On Saturday morning, the early warning goes to the competent CSIRT; the step is documented with time and content. On Monday, the incident notification with an initial assessment follows, and four weeks later the final report. The subsequent CAPA leads to improved network segmentation. When the supervisory authority reviews the case, all notifications with timestamps are available. ## Frequently asked questions When do NIS2 reporting deadlines start? From the moment the entity becomes aware of the significant incident. That is why the detection time is a mandatory field in docxpert. Does docxpert report directly to the authority? No. Notifications are submitted via the portal or channel of the competent authority or CSIRT. docxpert organises deadlines, ownership and evidence. Does docxpert support the Cyber Resilience Act? Yes. Incidents can be recorded as NIS2 or CRA cases; deadlines are calculated accordingly. What if an incident is later classified as not significant? Document the assessment and close the incident. The record shows that you assessed the incident. Who should be allowed to record incidents? Everyone who acts in an emergency: IT operations, information security, management. The owner handles the incident. Do I still need a ticketing system? Many teams keep their ticketing system for technical handling. docxpert adds the regulatory view: deadlines, notifications and evidence. ## Read next [NIS2 incident reportingWhen an incident is significant and what to report in 24 hours, 72 hours and one month.Learn more](https://docxpert.io/en/guides/nis2-incident-reporting) [NIS2Implement risk management measures, management training duties and reporting deadlines.Learn more](https://docxpert.io/en/standards/nis2) [NIS2 checklistScope, registration, risk measures, reporting channels and management training.Learn more](https://docxpert.io/en/checklists/nis2) [CAPA managementCorrective and preventive actions in nine phases – with 5 Whys, Ishikawa, deadlines and effectiveness checks.Learn more](https://docxpert.io/en/features/capa-management) [ISO 27001ISMS documentation, policies, Statement of Applicability and awareness training under control.Learn more](https://docxpert.io/en/standards/iso-27001) ## Try docxpert free for 14 days Document control, approvals, training and evidence in one platform – with English and German templates for more than ten standards. [Start free trial](https://docxpert.io/en/trial)[See pricing](https://docxpert.io/en/pricing)