Emergency · 24 hours
NIS2 incident: 24 hours, 72 hours and one month
The clock ticks faster than under GDPR. For a significant incident, an early warning must be submitted within 24 hours – and management is personally responsible for making that work. Here is the order of things.
Urgent Book a meeting or email us – we normally reply within one working day.
Unsure whether you are covered? Get in touch. We go through sector, size and exemptions – and what you would then need to have in place already today.
Scope
Does the Cybersecurity Act apply to us?
Sweden implemented NIS2 through the Cybersecurity Act (2025:1506). The Act covers organisations in a range of essential sectors – energy, transport, healthcare, drinking water, wastewater, digital infrastructure, IT services, public administration, postal services, waste management, chemicals, food, the manufacture of certain products, and digital services.
Roughly speaking, it applies to medium-sized and large organisations: at least 50 employees or more than EUR 10 million in turnover. Some organisations are covered regardless of size – for example qualified trust services, DNS services and providers of publicly available electronic communications services. There are also exemptions, and where the line falls is not always obvious.
If you are unsure: assume you may be covered and build the procedure anyway. The cost of having a working incident process is small compared with discovering the requirement in the middle of a crisis.
The reporting
Three deadlines, three different purposes
-
Early warning – within 24 hours
A short notice that a significant incident has occurred. You don't need to know the cause, the scope or the consequences. The purpose is to let the authority alert others and deploy resources early. Reporting is done through the national cyber portal.
-
Incident notification – within 72 hours
This is where the incident is assessed: severity, cause, consequences and indicators of compromise (for example file names, IP addresses or accounts used). This is the report that requires the most work – and it cannot be written after the fact.
-
Final report – within one month
A description of what happened, what caused it, which measures have been taken and what is being done to stop it happening again. Any cross-border impact also goes here.
Same incident, several notifications. An attack can simultaneously require an early warning under the Cybersecurity Act (24 hours), a personal data breach notification to IMY (72 hours) and a police report. You need one person who keeps all the strands together so that the information doesn't contradict itself.
Before it happens
This must be in place in advance
24 hours is a short time. Anything that has to be invented in the middle of the crisis will delay you.
- A contact list with names, roles, phone numbers and when they can be reached – including at night. Who makes decisions if you can't reach each other?
- A decision path for when an incident is "significant". Without a definition, every incident becomes a discussion in the management team.
- Logging that is good enough. Can you say which accounts were used, and when? If not, start logging before something happens.
- A report template for the three deadlines, with the fields filled in as far as possible in advance.
- Registration and management involvement. Organisations in scope must register with the supervisory authority, and management must approve the risk management measures. Shortcomings there can lead to personal liability.
- An exercise. A dry run of a scenario takes half a day and almost always uncovers three gaps you didn't know about.
Common mistakes
- Waiting until you understand the incident. The early warning requires no analysis. Send it, then analyse.
- Assuming the GDPR notification is enough. The deadlines are different, the recipients are different and the content is different.
- Leaving it to IT. Management is responsible, and it is management that gets asked why the procedure wasn't in place.
- Not practising. A process that has never been tested won't work at three in the morning.
- Forgetting your subcontractors. An incident at a supplier can be your incident if it affects your service.
Questions and answers
What we get asked
Are we covered if we have 40 employees?
The main rule is at least 50 employees or more than EUR 10 million in turnover, but some types of organisation are covered regardless of size. Drawing the line requires a review of your sector and your services.
What counts as a significant incident?
An incident that causes or can cause severe operational disruption of the service or financial loss. You make the assessment, and it must be documented – which is why you need criteria in advance.
Where do we send the notification?
Reporting is done through the national cyber portal, and your sector's supervisory authority may have its own instructions. Check which authority applies to your particular organisation.
What happens if we report too late?
Late or missing reporting is an infringement in its own right, separate from the incident. Administrative fines under the Cybersecurity Act can be substantial.
Can an incident require both a NIS2 and a GDPR notification?
Yes, and it is common. The same event can be both a significant incident under the Cybersecurity Act and a personal data breach under GDPR.
Do you help with the reporting?
Yes. We build the procedure, the templates and the decision path in advance, and we write the reports together with you when it counts.
Sources and further reading
- PTS – incident reporting under the Cybersecurity Act
- NCSC – how incident reporting works
- Cybersecurity Act (2025:1506)
Information from authorities changes. Always check the current rules and deadlines with the responsible authority, and take legal advice for legal assessments.
More urgent situations
Other situations we step into
Urgent
Is the 24-hour clock ticking?
We help you get the early warning out, write the incident notification and put the procedure in place so that next time isn't a crisis.
Urgent Book a meeting or email us – we normally reply within one working day.