Glossary
Incident notification
Formal communication of an incident to the competent authority within a fixed deadline, counted from the moment the entity became aware of it.
- Incident reporting
Almost every recent European regulation uses the same staged structure. NIS2 requires an early warning within 24 hours, a notification within 72 hours and a final report one month after the notification. The CRA mirrors those deadlines for actively exploited vulnerabilities and severe product incidents. DORA is tighter: initial notification within four hours of classifying the incident as major, and never more than 24 hours from becoming aware.
The failure point is almost never the act of reporting, it is the count. The clock does not start when the crisis is declared or when the committee convenes, but when the entity becomes aware of the incident — or when it classifies it, depending on the regulation.
That is why the decisive evidence is not the CSIRT acknowledgement, necessary as it is: it is the internal record fixing that starting instant to the hour, and the written criterion used to determine it.