Reporting an incident under NIS2
The 24-hour, 72-hour and one-month deadlines counted for you, drafts in the authority’s language prepared with what we saw, and a log of what was sent.
The Incidents page helps you report a significant security incident under NIS2 on time. It counts the deadlines for you and prepares each report in the language of the authority. You still decide whether the incident is significant, read each draft and send it yourself. Perimetry never sends anything to an authority.
Incident reporting is included from the Solo plan. It is help to prepare your reports, not legal advice.
The deadlines
NIS2 (Article 23 of the directive, § 32 BSIG in Germany) sets three reports, counted from the moment you became aware of the incident, not from when it started:
| Report | When |
|---|---|
| Early warning | Within 24 hours of becoming aware. Incomplete is fine; late is not. |
| Incident notification | Within 72 hours: a first assessment of severity and impact, and the indicators of compromise. |
| Final report | Within one month of the notification. If the incident is still ongoing then, send a progress report, and the final report within a month of handling it. |
The authority may also ask for an intermediate report. If personal data may be involved, a fourth deadline appears: the GDPR notification to your data protection authority, within 72 hours of becoming aware (GDPR Article 33).
Each deadline shows in your time zone, and turns to Due soon in its last 6 hours and Overdue after.
Open an incident
- Open Incidents in the menu.
- Give it a short title and the moment you became aware of it.
- Choose the authority: France (ANSSI, through CERT-FR), Germany (BSI), Ireland (NCSC) or another country.
- Say whether you suspect a malicious act, whether other countries may be affected, and whether personal data may be involved.
- Tick the domains concerned, or none for all your proved domains, then press Open the incident.
Prepare each report
On the incident’s page, What you know holds what you write: the reporting entity, a contact, what happened, the services affected, the impact, the indicators of compromise, the measures taken, the root cause. Fill in what you know as you go and press Save.
Drafts has one draft per report, in the authority’s language: French for the ANSSI, German for the BSI, English for Ireland and other countries. Each draft is rebuilt from what you wrote and from what Perimetry saw on the domains concerned:
- the external changes from 14 days before you became aware (new hosts, ports opened, name or mail servers changed, new certificates);
- the outages the uptime checks detected;
- the serious findings open in the latest audits.
Anything you have not filled in stays in brackets, for example [to complete]: nothing is invented. Read the draft, complete it, remove what you do not want to disclose, then Copy it or Download it as a text file and send it through the authority’s channel. Where to send it gives that channel, and the data protection authority when personal data are involved.
Record what was sent
Once a report is sent, open Mark as sent, choose the report, the time and the reference the authority gave you. The deadline turns to Sent, and the next drafts list the reports already sent with their references. The final report is then counted from the date the notification was actually sent.
Close an incident
When the incident is over, press Close the incident; you can reopen it. Owners and admins can delete an incident with its notes and its log of reports.
Who can do what
Owners, admins and members open incidents, update them and mark reports as sent. Viewers read everything, drafts included, and change nothing.
What you write is encrypted, and only your workspace can read it. The activity log records what was done (incident opened, report marked as sent), never what was written.