Habit 15 of 18
When things go wrong
Reporting contacts ready
You know who to tell and how fast: the NCSC, the Data Protection Commission, customers.
Some reports have deadlines measured in hours. Knowing who to tell, and how, before you need to is half the work.
Switch it on in the map Counts towards 5 articles, controls and categories
The incident clock works out the reporting deadlines from the moment you became aware.Open the incident clock
§1 How to do it
How a small firm does it
- Keep a short list of who to tell: the Data Protection Commission, the NCSC, your insurer, key customers and the Gardaí for crime.
- Note the deadlines that may apply, such as 72 hours for a personal data breach.
- Keep the list with the incident plan, and somewhere you can reach if your systems are down.
Evidence that shows it
- The contact list with the date it was checked
- Where it is kept, including an offline copy
Ireland: NCSC Ireland guidance on incident reporting applies here. Irish NIS2 law is still pending.
§2 What it counts towards
What it counts towards
Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.
EU NIS2 Directive 1 item
-
Art 23 Reporting significant incidents · supports
without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning
without undue delay and in any event within 72 hours of becoming aware of the significant incident, an incident notification
a final report not later than one month after the submission of the incident notification under point (b)
Article 23 sets stages for reporting significant incidents: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month of that notification. An intermediate report may be requested. If the incident is still ongoing when the final report is due, a progress report is sent then and the final report within one month of handling the incident. Knowing who to tell, including affected customers, is the first step.
Read Art 23(4) on EUR-Lex
General Data Protection Regulation 2 items
-
Art 33 Telling the DPC about a breach within 72 hours · intersects
without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority
Article 33 asks you to tell the Data Protection Commission about a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to put people at risk. If you are later, you must explain why. Having the contact ready makes the deadline realistic.
Read Art 33(1) on EUR-Lex -
Art 34 Telling affected people about a high-risk breach · supports
When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.
When a breach is likely to cause high risk, you must tell the people affected. Knowing how to reach them is part of being ready.
Read Art 34(1) on EUR-Lex
ISO/IEC 27001:2022 1 item
-
A.5.26 Responding to incidents · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
Responding to incidents includes telling the right people.
About ISO/IEC 27001:2022 on ISO
NIST Cybersecurity Framework 2.0 1 item
-
RS.CO Incident reporting and communication · supports
RS.CO-02: Internal and external stakeholders are notified of incidents
Knowing who to tell, inside and outside the business, is what makes this outcome possible.
Read RS.CO-02 on NIST
§3 Questions it answers
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.