[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nis2\u002F23":3},{"item":4,"lessons":16,"controls":38,"related":65},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nis2","23","Article 23","Reporting obligations",5,"Directive (EU) 2022\u002F2555 (NIS2)","**What it asks for.** Article 23 requires essential and important entities to notify their CSIRT or competent authority of significant incidents without undue delay. It sets staged reporting: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month, plus informing service recipients where appropriate.\n\n**In practice.** The entity has criteria for judging when an incident is significant, a named owner for regulatory reporting, templates for each stage and contact details for the relevant authority in every Member State where it operates. The clock starts at awareness, so detection and escalation must be fast. Evidence includes the reporting procedure, decision records and submitted reports.\n\n**Common gaps.** Organisations often lack agreed criteria for significance and lose time debating it. Groups operating in several countries may not know which authority to notify.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022L2555#art_23","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22,26,30,34],{"slug":19,"title":20,"published_at":21},"russias-hybrid-cyber-physical-attacks-target-european-nations-supporting-ukraine","Russia's Hybrid Cyber-Physical Attacks Target European Nations Supporting Ukraine","2026-09-25T08:20:21.965+00:00",{"slug":23,"title":24,"published_at":25},"pro-russian-group-launches-3-day-dos-attack-on-norwegian-government-services","Pro-Russian Group Launches 3-Day DoS Attack on Norwegian Government Services","2026-08-27T10:21:48.097+00:00",{"slug":27,"title":28,"published_at":29},"zero-knowledge-proofs-could-unlock-safer-cyber-risk-sharing","Zero-Knowledge Proofs Could Unlock Safer Cyber Risk Sharing","2026-08-04T13:20:19.201+00:00",{"slug":31,"title":32,"published_at":33},"eu-uk-sanction-gru-hackers-targeting-critical-infrastructure","EU & UK Sanction GRU Hackers Targeting Critical Infrastructure","2026-07-13T12:20:39.223+00:00",{"slug":35,"title":36,"published_at":37},"europe-becomes-ransomwares-primary-target-supply-chains-at-risk","Europe Becomes Ransomware's Primary Target — Supply Chains at Risk","2026-06-25T12:21:43.751+00:00",[39,44,48,52,57,61],{"slug":40,"name":41,"problem":42,"stories":43},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",2,{"slug":45,"name":46,"problem":47,"stories":43},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",{"slug":49,"name":50,"problem":51,"stories":43},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":53,"name":54,"problem":55,"stories":56},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",1,{"slug":58,"name":59,"problem":60,"stories":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":62,"name":63,"problem":64,"stories":56},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[66,71,76,80,84,90,95,99],{"family":67,"item":68,"code":69,"title":69,"together":70},"itil","overview","ITIL",4,{"family":72,"item":73,"code":74,"title":75,"together":70},"cis","13","Control 13","Network Monitoring and Defense",{"family":5,"item":77,"code":78,"title":79,"together":70},"21","Article 21","Cybersecurity risk-management measures",{"family":72,"item":81,"code":82,"title":83,"together":70},"17","Control 17","Incident Response Management",{"family":85,"item":86,"code":87,"title":88,"together":89},"nist-800-53","ir-4","IR-4","Incident Handling",3,{"family":91,"item":92,"code":93,"title":94,"together":43},"gdpr","32","Article 32","Security of processing",{"family":72,"item":96,"code":97,"title":98,"together":56},"7","Control 7","Continuous Vulnerability Management",{"family":72,"item":100,"code":101,"title":102,"together":56},"3","Control 3","Data Protection"]