Reporting significant incidents – procedures and deadlines
We prepare procedures that allow the organisation to recognise a significant incident and report it on time.
Reporting deadlines
NIS2 provides for staged reporting of significant incidents: an early warning without undue delay and within 24 hours of becoming aware, an incident notification within 72 hours and a final report within one month. Detailed rules are set out in the Polish KSC Act.
Scope of services
- Incident classification and handling procedure.
- Notification templates and the contact path to the competent CSIRT.
- Alignment with GDPR obligations where personal data are affected.
- Legal support during and after the incident.
Frequently asked questions
Must a cyber incident also be reported to the Polish DPA?
If the incident involves a personal data breach, in addition to the KSC notification the obligation to notify the President of UODO within 72 hours (Article 33 GDPR) must be assessed.
Let us discuss your matter
The first conversation is used to define the scope of the matter and the fee.