Incident handling, reporting obligations and supply chain security
This domain tests operational incident response and the Article 23 reporting clock, plus supply-chain duties. You must distinguish detection, early warning, notification and final report, and separate NIS2 timing from GDPR timing.
Reporting obligations
A significant incident is one that has a significant impact on service provision, causing severe operational disruption or financial loss, or affecting other persons. For significant incidents, entities notify without undue delay. The early warning is due within 24 hours of becoming aware; it flags suspicion of malicious cause and possible cross-border impact. The incident notification is due within 72 hours and updates severity, indicators and initial assessment. The final report is due within one month of the notification, covering root cause, impact, mitigations and cross-border effects. National law designates the CSIRT or competent authority as recipient.
Handling and supply chain
Maintain an incident-response plan with roles, escalation, evidence preservation, communications and recovery. Article 21(2)(d) requires supply-chain security in relationships with direct suppliers and service providers, based on assessed vulnerabilities and supplier practices. Article 22 allows coordinated EU-level risk assessments of critical supply chains.
Worked example
Ransomware is detected Monday at 09:00. The early warning goes by Tuesday 09:00; the incident notification by Thursday 09:00; the final report is due one month after the notification, not one month after detection. If personal data is breached, a separate GDPR notification to the data-protection authority may also be due within 72 hours. The team preserves logs, isolates hosts and informs the management body.
Traps
Do not wait for root cause before the 24-hour warning. Do not confuse the one-month final report with the 72-hour notification. Do not treat GDPR and NIS2 notifications as interchangeable. Do not assume only indirect suppliers matter; the duty focuses on direct suppliers. Do not forget cross-border and management escalation.