Glossary · NIS2
Final Report
The concluding NIS2 incident report, due no later than one month after the incident notification.
Explained in depth: NIS2 incident reporting timeline
The final report closes the Article 23 reporting cycle. It must contain a detailed description of the incident including its severity and impact, the type of threat or root cause likely to have triggered it, the mitigation measures applied and ongoing, and, where applicable, the cross-border impact. It is due no later than one month after the 72-hour incident notification. If the incident is still ongoing when the final report falls due, the entity submits a progress report instead, and the final report follows within one month of the incident actually being handled. A CSIRT or competent authority can also request intermediate status updates at any time during the incident.
Why it matters
The final report is where your incident response process becomes visible to the authority: root cause analysis, timeline, and remediation. A thin final report invites follow-up questions and, potentially, supervisory action. Treat it as the written record that demonstrates Article 21(b) incident handling actually works.