Incident Response — Article 23 NIS2
Obligation to respond to cybersecurity incidents under Art. 23 NIS2.
Definition
Art. 23 NIS2 sets out reporting obligations: 24h early warning, 72h initial assessment, 1 month final report. Plus internal incident response processes: detect, contain, eradicate, recover, lessons learned. In the NIS2 Kit: incident response playbook + reporting forms for 24h/72h/1M.
National implementation: Germany and Austria
Art. 23 of the NIS2 Directive (Directive (EU) 2022/2555) is a directive and only creates obligations through national implementation. The reporting deadlines — 24 hours early warning, 72 hours notification with an initial assessment, 1 month final report — are identical in substance in Germany and Austria; the reporting channel, the competent body and the relevant provisions differ, however.
Germany (BSIG)
- § 32 BSIG — reporting obligations: report to the joint reporting office of the Federal Office for Information Security (BSI) and the Federal Office of Civil Protection and Disaster Assistance (BBK). Early initial report within 24 hours, report with an initial assessment within 72 hours, final report no later than one month after the 72-hour report.
- Section 30 BSIG — risk management measures: appropriate, proportionate technical and organisational measures for particularly important entities and important entities.
- § 33 BSIG — registration obligation: registration with the BSI via the registration facility set up jointly by the BSI and the BBK.
Austria (NISG 2026)
- § 34 NISG 2026 — notification: report to the competent CSIRT (sector-specific, or the national CSIRT where there is none), which forwards the report without delay to the Cybersecurity Authority (Cybersicherheitsbehörde, Austria). Early warning within 24 hours, report within 72 hours, final report no later than one month after the 72-hour report.
- § 32 NISG 2026 — risk management measures: appropriate, proportionate technical, operational and organisational measures for essential entities and important entities.
- § 29 NISG 2026 — registration: registration with the Cybersecurity Authority, which maintains a register of essential entities and important entities.