Lesson 4.54: Incident reporting deadlines
When an incident is serious, laws start clocks. Under the EU's NIS2 directive, essential and important entities send an early warning to their national CSIRT within 24 hours, a notification within 72 hours and a final report within a month. Under GDPR, a personal data breach goes to the supervisory authority within 72 hours of becoming aware, and Turkey's KVKK has a similar 72-hour rule. US-listed companies disclose material incidents to the SEC within four business days. In the lab you take the timeline of a data theft through a partner's API key, read Northwind's obligations, calculate every deadline and find the first one.
15 min
You will learn to
- Explain NIS2, GDPR and similar reporting duties
- Identify when the clock starts
- Calculate deadlines with date
- Build a deadline list
- Know which obligations don't apply
Key terms
- NIS2
- EU directive on cybersecurity for essential and important entities, in force in member states since October 2024.
- GDPR Art. 33 / 34
- Notify the supervisory authority within 72 hours of becoming aware / tell affected people if the risk is high.
- KVKK
- Turkey's Personal Data Protection Law; breaches go to the Board within 72 hours.
- SEC Form 8-K Item 1.05
- US-listed companies disclose material cyber incidents within four business days of determining materiality.
- Becoming aware
- The moment the organisation has reasonable certainty that a reportable incident happened; it starts the clock.
← Defence in depth and least privilege · All lessons · Running a security champions programme →