---
title: "Communicate during an incident"
description: "Communicate during an incident, family Respond, NIS2 Art. 23"
url: https://www.alt-f1.be/en/table/cr/
organization: ALT-F1 SRL, Brussels (VAT BE 0830.560.718)
---

# Communicate during an incident

Short label: COMMUNICATE

Family: Respond · NIS2 Art. 23
<a id="meaning"></a>

## Meaning

Prepare who informs staff, customers, authorities and other relevant people after a security incident.

<a id="why"></a>

## Why it matters

Clear responsibilities reduce conflicting messages and help the team communicate what is actually known.

<a id="actions"></a>

## What you can do

Name the decision maker and spokesperson. Keep contact details and templates ready. Assess reporting duties for the incident and organisation concerned.

## Services that can help

Workshops can help prepare and practise an incident communication plan. Mandatory notification conditions belong beside any reporting deadline.

- [Workshops](https://www.alt-f1.be/en/workshops.md)

## Official reference — NIS2 Art. 23

> 1. Each Member State shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent authority in accordance with paragraph 4 of any incident that has a significant impact on the provision of their services as referred to in paragraph 3 (significant incident). Where appropriate, entities concerned shall notify, without undue delay, the recipients of their services of significant incidents that are likely to adversely affect the provision of those services. Each Member State shall ensure that those entities report, inter alia, any information enabling the CSIRT or, where applicable, the competent authority to determine any cross-border impact of the incident. The mere act of notification shall not subject the notifying entity to increased liability.
>
> — Directive (EU) 2022/2555 (NIS2), Art. 23(1)

> (a) without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning, which, where applicable, shall indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;
>
> — Directive (EU) 2022/2555 (NIS2), Art. 23(4)(a)

> (b) without undue delay and in any event within 72 hours of becoming aware of the significant incident, an incident notification, which, where applicable, shall update the information referred to in point (a) and indicate an initial assessment of the significant incident, including its severity and impact, as well as, where available, the indicators of compromise;
>
> — Directive (EU) 2022/2555 (NIS2), Art. 23(4)(b)

**What this reference concerns:** Covered entities must report significant incidents without undue delay: generally an early warning within 24 hours of awareness, notification within 72 hours and a final report within one month after notification. Specific exceptions and ongoing-incident rules apply.

[Read the article on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555#art_23) · Official text, quoted from the Official Journal of the EU