# Managing DNSC notifications (the 24h / 72h / 1 month rule)

> NIS2 requires significant incidents to be notified within strict deadlines. Here is what the process looks like.

When you have a significant security incident, NIS2 requires you to report to DNSC within strict deadlines. The reporting process has three cumulative stages, each with its own deadline. They do not replace one another, they complete one another: you start with a quick notification and report as you find out more, following the investigations.

  
### What a "significant" incident means

  Not every event is reported. An incident is significant when it has caused or may cause a serious operational disruption of services or financial losses, or when it has affected or may affect other persons through considerable material or non-material damage. The concrete criteria are detailed in the implementing regulations; the idea is to assess the impact, not just the technical cause.

  
### 1. Immediate notification, within 24 hours

  Within a maximum of 24 hours from the moment you became aware of the incident, you submit a first notification. It is brief: you signal that a significant incident has taken place and, where applicable, whether it appears to be caused by an unlawful or malicious action or whether it may have an impact on the critical service or a cross-border impact. You do not need all the details, just to report in time.

  
### 2. The notification, within 72 hours

  Within a maximum of 72 hours, you submit a more complete notification: an initial assessment of the incident (severity, impact) and, where possible, the indicators of compromise and the measures taken so far.

  
### 3. The final report, within approximately 30 days

  Within approximately one month of the notification, you submit the final report: a detailed description of the incident, the probable cause, the remediation measures applied and, where applicable, the cross-border impact. If the incident is still ongoing, an interim report is submitted, followed by the final one after resolution.

  
### Why it is hard in practice and how you prepare

  During an incident, deadlines are the first things to be missed: the team is focused on identifying and solving the problem, not on filling in forms and reporting. That is why it is very important to have prepared in advance an incident management procedure, clear roles and responsibilities, and the notification forms ready to fill in. An incident register also helps, one in which the incident traceability is built up as you progress, so that in the end the report provides a clear picture.