Glossary · NIS2
Early Warning
The first NIS2 incident report, due to the CSIRT within 24 hours of becoming aware of a significant incident.
Explained in depth: NIS2 incident reporting timeline
The early warning is the first of the three reporting stages under Article 23. It must be submitted without undue delay and in any event within 24 hours of the entity becoming aware of the significant incident. Its content is deliberately minimal: where applicable, an indication of whether the incident is suspected to be caused by unlawful or malicious acts, and whether it could have a cross-border impact. The early warning is not a full analysis. The directive explicitly states that reporting obligations should not divert resources from incident handling; the point is to alert the CSIRT quickly, enabling assistance and warnings to other potential victims, not to explain everything on day one.
Why it matters
24 hours passes quickly during an active incident. Organisations that hit the deadline have prepared: a documented significance assessment, on-call responsibilities, the national reporting channel bookmarked, and a template pre-filled with everything that never changes.