BSI Reporting Portal (24/72/30)
Incident reporting channels under NIS2
TL;DR
Under § 32 of the German BSI Act (BSIG), essential and important entities must report incidents to the BSI: 24-hour initial report, 72-hour update, 30-day final report. Portal: bsi.bund.de/meldungen.
What is the BSI Reporting Portal (24/72/30)?
Mandatory content of the initial report:
- Time and type of the incident
- Initial damage assessment
- Initial measures
- Contact person
72-hour update: detailed damage assessment, technical indicators, further measures.
Germany and Austria: different reporting channels
The three-stage reporting deadlines are identical in both countries because they transpose the same NIS2 Directive: early warning within 24 hours of becoming aware, a report with an initial assessment within 72 hours, and a final report no later than one month after the 72-hour report. What differs is the recipient body and the competent authority.
Germany
Under § 32(1) nos. 1 to 4 BSIG (BSIG 2025), particularly important entities and important entities report significant security incidents to the joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK): 24-hour initial report, 72-hour report with an initial assessment, and a final report no later than one month after the 72-hour report. If the incident is ongoing, an interim progress report comes first. The competent authority is the Federal Office for Information Security (§ 1 BSIG). Portal: bsi.bund.de/meldungen.
Austria
In Austria, the report does not go to the BSI but to the competent sector-specific or national CSIRT. Under § 34(2) of the Austrian Network and Information Systems Security Act 2026 (NISG 2026, BGBl. I Nr. 94/2025), essential and important entities likewise report in three stages: early warning within 24 hours, a report with an initial assessment within 72 hours, and a final report no later than one month after the 72-hour report. The CSIRT forwards the report to the Cybersecurity Authority (Cybersicherheitsbehörde, Austria), a subordinate authority of the Federal Minister of the Interior, which exercises supervision as the competent authority (§ 3a NISG 2026). A separate BSI reporting portal (bsi.bund.de) does not apply in Austria.
Practical example
Ransomware incident at 10 p.m. on Friday: the 24-hour deadline ends at 10 p.m. on Saturday. Direct access: bsi.bund.de/meldungen, telephone 0800-274-1000 (24/7).