Go to content

NIS2 report an incident

The NIS2 Directive prescribes that important and essential organizations should report significant incidents at the Computer Security Incident Response Team (CSIRT) and the supervisor.  A phased reporting obligation applies. The first report is an early warning that should take place as fast as possible, and in any case within 24 hours after the detection of the incident. This form enables you to report an incident.

NB: do not fill in any personal data without permission.

Assistance during an incident

Organizations can report incidents via cert@ncsc.nl or make use of the NIS2 reporting form below.
For (emergency) contact details and direct assistance during a cyber incident, we refer to our 24-hour helpdesk at: https://www.ncsc.nl/contact/24-uurs-hulp.
There you will also find the contact details of the other sectoral CSIRTs.

NIS2-Incident Form

Your organisation’s details
Enter the number under which the organisation is registered in the Chamber of Commerce’s commercial register.
Enter the name of the street where the organisation’s headquarters is located.
Enter the house number of the organisation’s headquarters.
Enter the town/city of the organisation’s headquarters.
Enter the postcode of the organisation’s headquarters.
Select your organisation’s primary sector
Does the organisation also fall under another sector?(required)
Other sectors(required)
My organisation is...(required)
Under the Critical Entity Resilience Act (Wet Weerbaarheid Kritieke Entiteiten), an organisation can be designated as a critical entity. The organisation is then considered an essential entity under the NIS2 Directive. If that is the case, select ‘essential entity’. More information about critical entities can be found in Directive (EU) 2022/2557. Essential and important entities are defined in the NIS2-directive. The Dutch Authority for Digital Infrastructure (RDI) self-assessment tool and National Cyber Security Centre (NCSC) flowchart can provide an indication of whether an organisation may be important or essential.
Notifier
The days and times when the notifier is available by phone.
Is the notifier also the contact person regarding the incident?(required)
If the notifier is not the contact person regarding the incident, the contact person’s details are also required.
Contact person

Complete this section only if the contact person is different from the notifier.

The days and times when the notifier is available by phone.
General information
Is this notification voluntary? Does it concern a significant incident?(required)
An incident is considered significant if: the incident has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned; or it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.
Is it suspected that the significant incident was caused by unlawful or malicious acts?(required)
What type of notification is this?(required)
The NIS2-directive contains a phased notification obligation. Early warning (phase 1): This is the initial notification, which must be submitted within 24 hours. For domain registration services and entities that fall under the ‘electricity network code’ implementation order, these notifications must be submitted within four hours. Notification, update and initial assessment (phase 2): This notification is an update on the early warning, it must be submitted within 72 hours after the incident is identified and it is an initial assessment of the incident, containing the following information: - The severity and consequences of the incident - If available: damage indicators Progress report or final report: A progress report contains relevant updates of the situation and can be requested by the CSIRT or the competent authority. A final report of the incident must be submitted within a month of the update and initial assessment. If the incident is still ongoing, this notification must be submitted no later than one month after the handling of the incident. The report must include the following: - A detailed description of the incident, including its severity and impact; - The type of threat or root cause that is likely to have triggered the incident; - Applied and ongoing mitigation measures; - Where applicable, the cross-border impact of the incident
What is the status of the incident?
The status of the incident gives an indication of the phase the incident is in.
For significant incidents with a cross-border impact, the national CSIRT informs other EU member states.
For cross-border inci-dents we want to share information international-ly to minimise the risk of a larger impact.
Incident details
The time (in the GMT +1 time zone) at which the incident was discovered.
Give a description of the incident that is as detailed as possible based on the information currently available. Provide as much context as possible. Indicators of compromise may also be included in this field.
Describe the visible and expected impact of the incident. This could include: whether critical processes have been affected and if so, which ones; the incident’s impact on the organisation and the potential or expected impact on customers; whether there is a visible or expected impact that has national security implications or entails a risk of loss of human life or disruption of public order.
Where possible, provide information about the cause of the incident, such as human error, a software vulnerability, etc. In addition, state what measures have been taken to prevent a repeat incident. It is possible to attach reports at the end of this form.
Have customers been informed / will they be informed?
If available, give the expected recovery time in days and hours.
Is help from the CSIRT needed? If so, please also contact your sectoral CSIRT by phone. State here what help is needed, and what the organisation itself is already doing, including engaging a third party to provide support.
This is where to upload any reports, such as investigation results, information about the cause of the incident, or an overview of the measures taken to prevent a repeat incident.
Has the incident been reported to the police?
It is advised to always report an incident to the police if it was caused intentionally.
Any additional information that has not been included elsewhere on the form can be provided here.
Information about the processing of your personal data

We use your data to handle the incident notification that you submitted. The information will be shared only with the National Cyber Security Centre (NCSC) and, where applicable, the relevant CSIRT.

Statement of agreement(required)