What is a significant incident under NIS2? The EU's staged incident reporting test, defined

A significant incident, under Article 23 of the EU's NIS2 Directive (Directive (EU) 2022/2555), is an incident that has caused or can cause severe operational disruption of services or financial loss for the entity, or considerable material or non-material damage to other people or organizations. Essential and important entities must report it in stages to their national authorities.

The reporting clock

Reports go to the national computer security incident response team (CSIRT) or the competent authority. The Directive requires an early warning within 24 hours of becoming aware, flagging any suspected malicious cause or cross-border impact. An incident notification follows within 72 hours with an initial assessment of severity and impact and, where available, indicators of compromise. A final report is due no later than one month after that notification.

The same article says the mere act of notification shall not expose the entity to increased liability. Where appropriate, entities must also tell the recipients of their services about significant incidents likely to affect those services.

Hard thresholds for digital providers

For cloud, data centre, DNS, managed service and managed security service providers, online marketplaces, search engines, social networks and some others, Implementing Regulation (EU) 2024/2690 of 17 October 2024 sets numbers. An incident is significant if, among other criteria, it causes or could cause direct financial loss above €500,000 or 5% of annual turnover, whichever is lower, or exfiltration of trade secrets. Smaller incidents count as one if they recur at least twice within six months from the same apparent root cause and together meet the financial threshold.

How it is enforced

Member States had to apply their national NIS2 rules from 18 October 2024. For essential entities that breach Article 23, they must provide maximum fines of at least €10 million or 2% of worldwide annual turnover, whichever is higher. On 28 November 2024 the European Commission opened infringement procedures against 23 Member States for incomplete transposition. On 7 July 2026 it referred Ireland, Spain, France and the Netherlands to the Court of Justice and asked for financial sanctions.

What it is not

A significant incident is measured by impact on services, not by whether personal data was touched; that test belongs to GDPR Article 33. It is also not the SEC's materiality test behind Form 8-K Item 1.05, which runs four business days from a materiality decision rather than 24 hours from awareness.

Where it appears on cisonews.net

This record is built mainly from US filings and notices. For the US counterpart to staged incident reporting, see the Item 1.05 guide and the state breach notice guide.