Article 23(3) Significant incident criteria
When an incident becomes reportable: the Directive's two-part test, and the quantified criteria, recurring incident rule and exclusions that Implementing Regulation 2024/2690 adds for digital entities.
Reporting obligations
Article 23 incident reporting: when an incident is significant, the 24-hour early warning, 72-hour notification and one-month final report, informing service recipients, plus registration and information-sharing duties toward authorities.
IR 2024/2690 Articles 5 to 14 Significant incident thresholds by entity type
The availability, user-impact and data-integrity thresholds that make an incident significant for each digital entity type, from DNS and cloud providers to online platforms and trust service providers.
Article 23(4)(a) Early warning within 24 hours
The first reporting step: an early warning to the CSIRT or competent authority within 24 hours of becoming aware of a significant incident, what it must indicate, and the response entities can expect.
Article 23(4)(b) Incident notification within 72 hours
The second reporting step: an incident notification within 72 hours that updates the early warning with an initial assessment of severity and impact and any indicators of compromise, and the 24-hour rule for trust service providers.
Article 23(4)(c) to (e) Intermediate, final and progress reports
The follow-up reports: intermediate status updates on request, the final report due one month after the incident notification with root cause and mitigation, and the progress report when an incident is still ongoing.
Article 23(1) and (2) Notifying service recipients
When entities must tell their own customers and users about significant incidents and significant cyber threats, and what measures recipients can take in response.
Article 27 Registry of entities
The registration duty for DNS, TLD, domain registration, cloud, data center, CDN, managed service and online platform providers, the information they had to submit by 17 January 2025, and the ENISA registry.
Article 29 Cybersecurity information-sharing arrangements
Voluntary exchange of threat intelligence among entities, the duty to tell authorities when joining or leaving a sharing arrangement, and voluntary notification of incidents, threats and near misses under Article 30.
