IncidentLiveNIS2 gives you 24 hours. Spend them on the incident.
A significant security incident starts the clock: 24 hours for the early warning, 72 hours for the incident notification, a month for the final report. IncidentLive drafts each report from the incident's timeline while your team contains it. You check the facts and send it.
The NIS2 reporting deadlines
The clock starts when you become aware of a significant incident: one that has caused or can cause severe disruption or financial loss for your company, or considerable damage to others. Here is what each report asks for and what IncidentLive takes from the timeline.
What IncidentLive fills in from the timeline
- 24 h
Early warning
Within 24 hours: that there is a significant incident, whether it may have been caused by an unlawful or malicious act, and whether it could affect other countries.
IncidentLive fills in: When the incident was detected, the first report and what is known so far. What only a person can judge, such as a suspected attack, stays a question for your team.
- 72 h
Incident notification
Within 72 hours: an update of the early warning with a first assessment of severity and impact and, where available, indicators of compromise.
IncidentLive fills in: The severity, the affected services and systems, and the observations and findings so far, each with its source.
- Any time
Interim report
Whenever the BSI asks: the current status of the incident.
IncidentLive fills in: The current briefing, with what changed since the last report.
- 1 month
Final report
One month after the notification: a detailed description, severity and impact, the type of threat or root cause, the measures taken and still under way, and any effect on other countries. If the incident is still going on, a progress report comes first.
IncidentLive fills in: The confirmed root cause and the measures from the timeline. A cause is only named once a person has confirmed it.
How IncidentLive drafts NIS2 reports
During a security incident, the people who know the facts are the ones busy containing it. IncidentLive collects tickets, alerts, notes, files and what coding agents report on one timeline while they work, and drafts each report from there.
Drafted while your team contains the incident.
Each point links to the timeline entries it comes from, with their times. If the BSI asks, you can show where it came from. What only a person can judge stays a question for your team.
- Nothing is made up to fill a field
- A suspicion stays a suspicion until someone who manages the incident confirms it
- Who may see an entry is checked before anything is summarized
Checked and sent by people.
IncidentLive never sends a report on its own. A person checks it and submits it through the BSI's reporting portal, and the timeline records when it went out.
- Each report shows when it is due: the first two from detection, the final report from the notification
- Drafts stay on your own servers, with a local AI model or none
- The final report names only a cause a person has confirmed
Want the first draft waiting before the clock runs out?
Become a pilot teamWho does NIS2 apply to?
NIS2 is the EU directive on cybersecurity. Germany has written it into the BSI Act. It applies to companies in sectors that matter for society and the economy, once they reach a certain size, and they have to report significant security incidents to the BSI.
The sectors
- Sectors of high criticalityEnergy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, managed IT services, public administration and space.
- Other critical sectorsPostal and courier services, waste management, chemicals, food, manufacturing (among others medical devices, electronics, electrical equipment, machinery and vehicles), digital providers and research.
The size
- Medium-sized companies and largerAs a rule from 50 employees, or from more than 10 million euros in both annual turnover and balance sheet total.
- Some regardless of sizeFor example providers of DNS, top-level domains, trust services and public communication networks.
- Essential or importantSector and size decide which of the two groups a company belongs to. The reporting duties are the same for both.
Whether your company is covered is a legal question. The BSI offers a check on its website, and your legal advisers can tell you for sure.
Questions about NIS2 reporting
Who has to report under NIS2?
Companies in the sectors NIS2 lists, as a rule from 50 employees or more than 10 million euros in turnover and balance sheet total, and some providers regardless of size. Both essential and important entities have to report.
What counts as a significant incident?
A security incident that has caused or can cause severe disruption of your services or financial loss for your company, or that affects others with considerable damage.
Where do NIS2 reports go in Germany?
To the BSI, the Federal Office for Information Security, through its reporting portal.
Does IncidentLive send the reports to the BSI?
No. IncidentLive drafts them. A person on your team checks each one and submits it.
Can IncidentLive also write our 8D or CAPA report?
Yes, from the same timeline: the 8D report for the car industry and the CAPA report for medical devices, pharma and food.
Three reports, one timeline
8D report
For carmakers and their suppliers, and anyone whose customers ask for 8D.
- IATF 16949
- VDA
CAPA report
For medical devices, pharma and food, with an effectiveness check that stays open until there is proof.
- ISO 13485
- EU MDR
- IFS Food
NIS2 reports
For companies that fall under NIS2: the early warning, the incident notification and the final report.
- NIS2
- BSI
This page
Let's try it with your incidents.
We're looking for a few pilot teams. If your company falls under NIS2 and you'd rather not write the first report at three in the morning, tell us about your setup and we'll get IncidentLive running with you.
- You write or callTell us which tools you use and how incidents run for you today.
- We set it up with youOn your own servers, connected to the tools your team already uses.
- Your team tries it on real incidentsAnd when a reportable incident comes, the first draft is already waiting.