The Cyberbeveiligingswet (Cbw), the Dutch NIS2 law, requires covered organisations to report significant incidents. Not all at once, but in stages, and the first stage is due within 24 hours. That's short, especially at night or over a weekend. This article explains what to report, when, to whom, and how to make sure you meet the deadline.
What is a significant incident?
An incident is significant if it:
- causes or can cause severe disruption of your services or financial loss for your organisation, or
- affects or can affect others (people or organisations) by causing considerable material or non-material damage.
Note the word "can": an incident that hasn't caused damage yet, but could have, may still have to be reported. Think of ransomware stopped just in time, or a break-in on an admin account. Sector-specific thresholds may be set later.
The four stages
| When | What | Contents |
|---|---|---|
| Within 24 hours | Early warning | A significant incident has occurred. Do you suspect malicious intent? Could it have impact in other EU countries? |
| Within 72 hours | Incident notification | An update and initial assessment: how severe, what impact, and where available the characteristics of the attack (indicators of compromise). |
| On request | Intermediate report | If the CSIRT or regulator asks for one. |
| Within one month | Final report | A detailed description: severity and impact, the type of threat or root cause, measures taken, and any cross-border impact. Still ongoing? Send a progress report and follow up with the final report later. |
The deadlines run from the moment you become aware of the incident, not from when the attack started. But without monitoring you often find out late, and then you also have to explain how long the attacker had been inside.
Who do you report to?
You report to your sector's CSIRT (for many organisations that is the NCSC) and to your regulator, via the reporting portal. In certain cases you must also inform your customers about a significant incident that may affect them, and about measures they can take themselves.
Note: GDPR is a separate obligation. If personal data was exposed, the GDPR also requires you to report the data breach within 72 hours to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). That is a different report to a different authority.
How to make the 24 hours
Most organisations don't get stuck on the form, but on what comes before it: do we notice in time, who decides it's significant, and who presses send. Arrange this in advance:
- Visibility. You can only report what you see. Monitor your systems and get alerts on suspicious activity, including outside office hours.
- One owner and a deputy. Record who assesses whether an incident is significant, and who takes over when they're away.
- A template. Put the questions from the early warning and the 72-hour notification in a document, so you only need to fill them in.
- Contact details on paper. Reporting portal, NCSC, regulator, your IT provider, your insurer, and the people who communicate with customers. On paper, because your email may be down.
- A log from minute one. Write down what you see, what you do and when. You'll need it for the 72-hour notification and the final report.
- Practise. Once a year, walk through a scenario such as ransomware on a Friday evening. You'll find what's missing before you really need it.
How OZAG Security helps
OZAG Security watches your systems around the clock and links separate alerts from the same attacker into one incident, with the timeline, affected systems, attacker IP addresses and techniques used (MITRE ATT&CK). That is exactly the information you need for the 24- and 72-hour reports. The AI analyst writes an assessment in plain language, and the reports help with the final report. Try it free for 14 days.
Read also: NIS2 checklist for SMBs: the 10 measures in practice
This article is general information, not legal advice. In an incident, always follow the current instructions from the NCSC and your regulator.