Incidents

Declaring and tracking security incidents against the regulatory notification deadlines imposed by NIS2.

The three regulatory milestones

Milestone	Deadline
Early warning	24 h
Notification	72 h
Final report	1 month

Where the deadlines start counting

The clocks start from the detection date and time, not the date the incident is declared in the tool. It is the single most important field on the record — entering it approximately throws off every milestone.

The milestones only appear if the incident is marked "Subject to regulatory notification".

Declaring an incident

Fields: title, description, detection date and time, severity (Minor / Major / Critical), and the regulatory notification indicator.

Tracking

Three KPIs at the top of the list: open incidents, due in < 24 h, overdue. The list shows, for each incident, its title, severity, status (Open / In progress / Closed) and next deadline.

Incident record

The detail page carries the regulatory milestones (deadline and completion date), the root cause, the corrective measures and the treatment history.

The Record button generates the notification document matching the selected milestone.

Linking to a risk analysis

An incident can be linked to an EBIOS risk, a PHA scenario or an FMEA failure mode from an open project. This is what lets you compare the anticipated risk against the incident that actually occurred.

TIP

Linking requires an analysis project to be open. Without one open, the selector stays empty — the incident can still be declared.