NIS2 reporting obligation: when and how to report incidents to the BSI
You report a significant security incident to the BSI in three stages: an early warning within 24 hours, a notification within 72 hours and a final report one month later (§ 32 BSIG). The clock runs from the moment you learn of it. You report in the BSI's portal.
Programmes and memberships
What a significant security incident is
A security incident is an event that compromises the availability, integrity or confidentiality of your data or services (§ 2 no. 40 BSIG). You only have to report significant incidents.
An incident is significant if it has caused, or can cause, one of two things (§ 2 no. 11 BSIG, Art. 23(3) NIS 2): severe operational disruption or financial loss for your company, or considerable damage to others. For certain digital providers, Implementing Regulation (EU) 2024/2690 sets exact thresholds. For everyone else, the BSI says: an incident is significant if it meets one of the criteria in Art. 3(1) of that regulation, and always when a critical service fails or is impaired.
Severe operational disruption
The incident seriously disrupts the provision of your services, or can.
Financial loss
The incident causes financial loss for your company, or can. For the digital providers covered by the implementing regulation, the threshold is a direct loss above EUR 500,000 or 5 % of the previous year's turnover, whichever is lower (Art. 3(1)(a)).
Damage to others
The incident causes other people or companies considerable material or non-material damage, or can.
Data breach
A data breach is significant only if it meets one of the two criteria, for example because it causes considerable damage to others. Reporting under § 32 BSIG sits next to notification under Art. 33 and 34 GDPR. Both can apply to the same incident.
Duration
Duration is not a criterion of its own. For the digital providers covered by the implementing regulation, time limits apply per service, for example a cloud service that is completely unavailable for more than 30 minutes (Art. 7(a)).
When in doubt, report early. The BSI explicitly wants early reports, even while much is unclear. Corrections go into the later reports.
More on thisThe clock starts with awareness. According to the BSI, that is the moment an employee of your company learns of the significant incident during working hours.
Early warning
24 hoursA first warning to the BSI, at the latest 24 hours after you learned of the incident.
- Whether the incident is suspected to come from an unlawful or malicious act
- Whether it could affect other countries
- A first classification of the incident
- Who is reporting, and how the BSI can reach that person
Incident notification
72 hoursAt the latest 72 hours after you learned of the incident. It confirms or updates the early warning.
- A first assessment of severity and impact
- Signs of the attackers (indicators of compromise), where available
- What you know about the cause
- What you have done and still plan to do
Intermediate report
On requestOnly if the BSI asks for it: the current status.
- Status of containment and recovery
- New findings on cause, scope or impact
Final report
1 month after the notificationAt the latest one month after the notification from the 72-hour deadline.
- A detailed description of the incident, with severity and impact
- The type of threat or the likely cause
- What you have done and are still doing
- Whether other countries are affected
Progress report
If the incident is ongoingIf the incident is still ongoing after a month, you submit a progress report instead of the final report. The final report follows once the incident has been dealt with (§ 32(2) BSIG).
- The current status
- What you have contained so far
An example
A made-up company. Monday, 9 am: accounting tells IT that files on the server are encrypted. Order intake has stopped.
Monday, 9.30 am: IT confirms an attack. Under the incident plan, the managing director decides. He classes the incident as significant because operations are seriously disrupted.
Monday, 2 pm: the early warning in the BSI's portal. It says what is known and that an attack is suspected. The deadline would have run until Tuesday, 9 am.
Thursday, 9 am at the latest: the notification, with a first assessment of severity and impact.
One month after that notification: the final report with cause and remedy. If the incident is still ongoing then, a progress report comes first.
In parallel, the company checks whether personal data is affected. If so, the notification duty under Art. 33 GDPR applies as well.
What goes into the early warning
The BSI lists these details for the early warning. The form in the portal asks for them.
- Classification of the incident, reason for the report and situation
- A preliminary description: disruption, impact, expected duration and suspected cause
- When the incident happened and when you noticed it
- Affected sectors and types of entity
- Whether an attack is suspected and whether other countries could be affected
- What you have done so far and whether the incident is under control
- How the BSI can reach the person reporting
The BSI's rule: speed before completeness. A report that has been submitted cannot be withdrawn. You correct it with a follow-up report.
How the walkthrough does this
Two steps in the walkthrough at nisd2.eu prepare you for reporting.
"Plan what happens in an incident": your answers produce your incident response plan. It says who decides and how you report.
"Know how to report an incident": the step shows the three deadlines and an example of an early warning.
You record whether you can sign in to the BSI's portal and report.
At the end, management approves the incident response plan in the app.
Reports under § 32 BSIG go to the BSI, normally through the BSI's portal. If your company has a significant incident before it has registered, you report through a form in the BSI's reporting and information portal (MIP). Operators of critical facilities and federal authorities use their previous reporting channels for now.
Any employee with access to the portal can report. Each person needs their own organisation certificate from ELSTER and must be assigned to your entity in the portal. You can also have a service provider report for you. Responsibility for the report stays with you.
Operators of critical facilities also report the type of facility, the critical service and the impact on it (§ 32(3) BSIG). If personal data is affected, a notification to the data protection authority may be needed as well.
After the report
- The BSI confirms receipt without undue delay, within 24 hours where possible. On request, it gives guidance or advice (§ 36(1) BSIG).
- The BSI can order you to inform the recipients of your services about the incident (§ 35(1) BSIG).
- Expect follow-up questions. The BSI recommends that its warnings reach someone outside business hours too.
What to prepare in advance
- Who decides whether an incident is significant, and who reports.
- Access to the BSI's portal for those people: one organisation certificate each and assignment to your entity.
- The phone numbers of IT, service providers and management, on paper too.
- An incident plan that people can find even when the servers are down.
Sources
- BSI Act (BSIG), § 2 nos. 11 and 40, §§ 32, 35 and 36 (gesetze-im-internet.de/bsig_2025)
- Directive (EU) 2022/2555 (NIS 2), Art. 23 (eur-lex.europa.eu)
- Implementing Regulation (EU) 2024/2690, Art. 3 and 7
- BSI, NIS 2 reporting duty: deadlines, content and channel (bsi.bund.de/dok/nis-2-meldepflicht)
- BSI, Mein Unternehmenskonto: access to the BSI portal (bsi.bund.de/dok/muk)
- Regulation (EU) 2016/679 (GDPR), Art. 33 and 34
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
Incident Handling
Know how to report an incident
Three reports to your authority, with fixed deadlines.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.