AI answer written only from the numbered passages below
NIS2 sets three sequential deadlines for a significant incident: an early warning within 24 hours to the national authority or CSIRT, flagging a suspected malicious cause or cross-border effect 1. A fuller incident notification follows within 72 hours, covering severity, impact and indicators of compromise 1. A final report is due within one month, setting out root cause, measures taken and consequences 1. The Dutch Cyberbeveiligingswet mirrors these same three steps — 24 hours, 72 hours, one month — as part of its phased incident-reporting duty 2.
Not in the sources: The passages do not give the exact thresholds for when an incident counts as 'significant'; they say these sit in implementing rules and national law [1].
Cited passages
Passage 1: The three deadlines
For a significant incident, NIS2 sets three sequential deadlines: an early warning within 24 hours to the national authority or CSIRT (flagging a suspected malicious cause or cross-border effect); a fuller incident notification within 72 hours (severity, impact, indicators of compromise); and a final report within one month (root cause, measures taken, consequences). 'Significant' broadly means an incident causing serious operational disruption or financial loss, or that could materially affect other parties — the exact thresholds sit in implementing rules and national law.
NIS2's 24/72-hour incident reporting duty, explainedAdapted from trusq's NIS2 incident-reporting explainer · eur-lex.europa.eu · retrieved 18 Sep 2026
Passage 2: Three core duties
The law rests on three obligations: a duty of care (appropriate technical and organisational measures based on a risk assessment), a phased incident-reporting duty (an early warning within 24 hours of a significant incident, a fuller notification within 72 hours, and a final report within a month), and a registration duty with the competent authority. Management-body liability is explicit: the board must approve the measures, oversee compliance, and can be held accountable for failing to do so. Supervision sits with sectoral regulators together with the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur, RDI).
The Cyberbeveiligingswet: NIS2 becomes Dutch law (energy-sector angle)Rijksoverheid.nl / NCTV, with explanatory text adapted from trusq's Cyberbeveiligingswet page · rijksoverheid.nl · retrieved 18 Sep 2026
Sources consulted
- NIS2's 24/72-hour incident reporting duty, explainedAdapted from trusq's NIS2 incident-reporting explainer · eur-lex.europa.eu · retrieved 18 Sep 2026 · cited
- The Cyberbeveiligingswet: NIS2 becomes Dutch law (energy-sector angle)Rijksoverheid.nl / NCTV, with explanatory text adapted from trusq's Cyberbeveiligingswet page · rijksoverheid.nl · retrieved 18 Sep 2026 · cited
General information from public sources, not legal advice. Passages are our own-words summaries of the linked publications; follow the link for the authoritative text.