Governance, incident reporting and supervision
Domain 3 - Governance, incident reporting and supervision
This domain tests the accountability chain: who owns cybersecurity risk, what must be reported and when, and how authorities supervise and sanction.
Governance and reporting rules
Under Article 20, the management body of an essential or important entity approves the cybersecurity risk-management measures, oversees their implementation, and is accountable for compliance. Member States must provide for management-body liability for infringements. Members must undertake cybersecurity training, and the entity may offer similar training to employees.
Article 23 requires notification of 'significant' incidents to the CSIRT or competent authority. A significant incident has caused or is capable of causing severe operational disruption or financial loss, or considerable material or non-material damage to others. The clock starts when the entity becomes aware. An early warning is due within 24 hours, including whether the incident is suspected malicious and may affect other Member States. An incident notification is due within 72 hours, with an initial severity assessment. A final report is due within one month, covering root cause, mitigation and cross-border effects. The CSIRT may request an intermediate report.
Supervision is differentiated. Essential entities face ex ante and ex post supervision, including audits, inspections, scans and information requests. Important entities face ex post supervision after evidence of non-compliance. Maximum fines must be at least €10 million or 2% of worldwide turnover for essential entities, and at least €7 million or 1.4% for important entities. Other measures include binding instructions and compliance orders.
Worked example
Ransomware is detected at an essential water utility on Monday at 09:00. The early warning is due Tuesday 09:00; the 72-hour notification is due Thursday 09:00; the final report is due one month after the notification. The utility should not wait for forensic proof before warning the CSIRT: the 24-hour test is suspicion, not confirmation.
Traps
The deadlines run from awareness, not from the attack start. An early warning is not a substitute for the 72-hour notification. Reporting only confirmed data breaches misses availability incidents. Delegating to a CISO does not transfer management-body accountability.