Free Tool
NIS2 Incident Report Generator
Pre-fill your Article 23 early warning (24h) and incident notification (72h) from real incident data. Generates all four required report stages with the fields your national CSIRT expects.
The NIS2 Reporting Clock
Article 23 imposes strict reporting deadlines. The clock starts the moment you become aware of a significant incident.
24 Hours: Early Warning
Must include whether the incident is suspected to be caused by unlawful or malicious acts, and whether it could have cross-border impact. This is a rapid initial notification, not a full analysis.
72 Hours: Full Notification
Update the early warning with an initial assessment: severity, impact, indicators of compromise where available. For DDoS incidents, this means attack classification, peak volumes, affected services, and mitigation actions.
1 Month: Final Report
Detailed description of the incident including root cause analysis, mitigation measures applied, and cross-border impact if any. Must also include the type of threat or root cause that likely triggered the incident.
Automate your NIS2 incident evidence
Flowtriq captures detection timestamps, attack classification, traffic volumes, source analysis, and mitigation actions automatically. Every incident generates the evidence Article 23 requires.
Start your free trial →Skip the manual entry. Get this automatically.
Flowtriq generates every field in this report the moment an incident is detected. Enter your email for a walkthrough of the automated NIS2 evidence workflow.
No spam. Unsubscribe any time.
NIS2 Readiness Checklist: Incident Reporting
Verify your organisation can meet Article 23 obligations before an incident occurs.
| Requirement | What You Need |
|---|---|
| Detection capability | Automated detection that creates timestamped incident records within seconds, not hours |
| 24h early warning template | Pre-drafted notification template with placeholders for incident type, malicious intent assessment, cross-border flag |
| 72h notification data | Ability to export severity, classification, peak volumes, source analysis, affected services, and mitigation actions |
| CSIRT contact identified | Know your national CSIRT, their submission portal/email, and any required format or reference number scheme |
| Internal reporting contact | Named person with authority and training to file NIS2 notifications on behalf of the entity |
| Evidence preservation | PCAP captures, flow logs, audit trails, and mitigation records retained for the final report (30 days minimum) |
| NIS2 registration | Entity registered with national competent authority. Most enforcement actions to date have targeted registration failures, not control gaps. |
Note: NIS2 covers ten categories of security measures under Article 21. DDoS detection, network monitoring, and incident handling are required controls. This tool helps with incident reporting evidence. It does not address all ten Article 21 categories. Consult your legal team for full compliance scope.
Frequently Asked Questions
FAQ