---
title: "Investigate a security incident"
description: "Investigate a security incident, family Respond, NIS2 Art. 23"
url: https://www.alt-f1.be/en/table/fo/
organization: ALT-F1 SRL, Brussels (VAT BE 0830.560.718)
---

# Investigate a security incident

Short label: INVESTIGATE

Family: Respond · NIS2 Art. 23
<a id="meaning"></a>

## Meaning

Reconstruct what happened using preserved evidence such as device events, account activity and website requests.

<a id="why"></a>

## Why it matters

An investigation helps identify affected systems and the recovery or notification decisions that need attention.

<a id="actions"></a>

## What you can do

Preserve relevant records and agree who will investigate. Record actions and avoid making unnecessary changes to affected systems.

## Services that can help

Device Shield and Web App Shield provide relevant event records. A forensic investigation and evidence-handling responsibilities must be agreed separately.

- [Device Shield](https://www.alt-f1.be/en/device-shield.md)
- [Web App Shield](https://www.alt-f1.be/en/web-shield.md)

## Official reference — NIS2 Art. 23

> 1. Each Member State shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent authority in accordance with paragraph 4 of any incident that has a significant impact on the provision of their services as referred to in paragraph 3 (significant incident). Where appropriate, entities concerned shall notify, without undue delay, the recipients of their services of significant incidents that are likely to adversely affect the provision of those services. Each Member State shall ensure that those entities report, inter alia, any information enabling the CSIRT or, where applicable, the competent authority to determine any cross-border impact of the incident. The mere act of notification shall not subject the notifying entity to increased liability.
>
> — Directive (EU) 2022/2555 (NIS2), Art. 23(1)

> (a) without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning, which, where applicable, shall indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;
>
> — Directive (EU) 2022/2555 (NIS2), Art. 23(4)(a)

> (b) without undue delay and in any event within 72 hours of becoming aware of the significant incident, an incident notification, which, where applicable, shall update the information referred to in point (a) and indicate an initial assessment of the significant incident, including its severity and impact, as well as, where available, the indicators of compromise;
>
> — Directive (EU) 2022/2555 (NIS2), Art. 23(4)(b)

**What this reference concerns:** Covered entities must report significant incidents without undue delay: generally an early warning within 24 hours of awareness, notification within 72 hours and a final report within one month after notification. Specific exceptions and ongoing-incident rules apply.

[Read the article on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555#art_23) · Official text, quoted from the Official Journal of the EU