NIS2 Incident Report: Template for Early Warning, Notification, and Final Report

This template is an internal worksheet. You submit the report itself via the NIS2-Services application, which the Federal Office for Cyber Security (Bundesamt für Cybersicherheit, BCS) provides through the Unternehmensserviceportal. Only if the reporting portal is temporarily unavailable for technical reasons does the BCS name PDF forms for each report type as an alternative reporting channel. The recipient is the CSIRT responsible for you; it forwards the report to the cybersecurity authority without undue delay (§ 34 para. 1 NISG 2026). According to its own website, the BCS is still working on a connection via the Portalverbund (Austrian government portal network) for public administration entities (as of October 5, 2026).

The structure and workflow of the template are a TOMORIS recommendation: you fill in Part A in advance and everything else during the incident. The law prescribes the deadlines, content, and recipients of the reports (§ 34 NISG 2026), significance (§ 35 NISG 2026, §§ 5 to 7 NISV 2026), and the obligations under Art. 33 GDPR. The field names follow the BCS forms for the alternative reporting channel (version 1.0, as of October 1, 2026); in the portal, the information requested there applies.

According to the BCS forms, the competent bodies are GovCERT for public administration (§ 8 para. 4 NISG 2026), Austrian HealthCERT for healthcare, and the national CERT for all other sectors; addresses for the alternative reporting channel: reports@govcert.gv.at, reports@a-healthcert.at, and reports@cert.at. Reporting obligations can also be fulfilled by a third party with the appropriate power of representation, such as your IT service provider (explanatory notes on § 5 NISV 2026). A supplier's report does not release you from your obligation: if the incident is significant for both entities, both report (BCS).

The early warning and notification are due within 24 and 72 hours, respectively, after becoming aware of the significant incident (§ 34 para. 2 no. 1 and 2 NISG 2026). According to the BCS, the 24 hours also run on weekends, even if you do not offer your services then. The law does not define exactly what “becoming aware” means. The BCS forms ask for the start and the first detection or awareness, each with date and time in Central European Time.

TOMORIS recommendation: if in doubt, calculate the deadlines from the earliest documented point in time and keep a log from the first observation. It provides the information for all reports and, if personal data is affected, serves as documentation under Art. 33(5) GDPR.

You must report every significant cybersecurity incident, meaning an event that compromises the availability, authenticity, integrity, or confidentiality of data or services (§ 3 no. 30 NISG 2026) and is significant. The NISV 2026 (BGBl. II No. 290/2026, promulgated on October 1, 2026) lists in § 5 cases that are significant in any case. According to the explanatory notes, “is capable of causing” in § 5 para. 1 no. 1 to 3 means that the effect is to be expected in the near future in the ordinary course of events. Check what has occurred or is imminent in this way.

• § 35 para. 1 NISG 2026: severe operational disruption of the services or severe financial losses for the entity (no. 1), or considerable material or non-material damage to other persons (no. 2).
• § 5 para. 1 no. 1 NISV 2026: direct financial loss exceeding €500,000 or 5% of annual turnover in the previous financial year, whichever is lower.
• No. 2: leakage of trade secrets within the meaning of § 26b UWG (Austrian Unfair Competition Act) or of information subject to secrecy under § 6 IFG (Austrian Freedom of Information Act).
• No. 3 and 4: death or serious damage to the health of a natural person.
• No. 5: successful, suspected malicious, and unauthorized access to network and information systems that is likely to cause severe operational disruption.
• No. 6 with § 7: at least two incidents in six months that are not significant on their own, with the same apparent root cause and impact, which together exceed the threshold from no. 1.
• No. 7 and 8: outage or limited availability of the services for more than 24 hours, for more than 100,000 users or 10% of users (whichever is lower), or in the territory of at least one federal state.
• No. 9: the incident has activated crisis management or disaster recovery plans of business continuity management.
• Exclusion under § 6 NISV 2026: only a scheduled interruption of operations or the planned consequences of scheduled maintenance work. This is not a significant incident.

The general criteria continue to apply alongside § 5 NISV 2026. Under § 35 para. 2 NISG 2026, these include the dependence of other sectors on your service, effects on the environment, public safety, or health, your market share, the affected area including cross-border impact, the affected systems, the severity of the threat, exploited vulnerabilities, and experience with similar incidents.

For entities under IR (EU) 2024/2690 (DNS, TLD name registries, cloud, data centers, content delivery networks, managed services and managed security services, online marketplaces, search engines, social networks, trust services), its Art. 3 and 4 and, depending on the type, Art. 5 to 14 apply; according to the explanatory notes, § 5 NISV 2026 governs the other entities. Managed services and managed security services additionally under Art. 10: completely unavailable for more than 30 minutes, limited for more than one hour for more than 5% or 1 million users in the Union (whichever is lower), or data compromised by a suspected malicious act or for this group of users.

Where applicable, state whether there is a suspicion that the incident was caused by unlawful or malicious acts or could have a cross-border impact (§ 34 para. 2 no. 1 NISG 2026). According to the BCS, the early warning should be reduced to the essentials and can only be submitted once; if the more detailed information is already available, you can submit the notification directly within the 24 hours. Take the entity, contact person, and points in time from Parts A and B.

The report does not replace a criminal complaint to the police (note in the BCS form); if a criminal background is suspected, the CSIRT provides guidance on reporting to law enforcement authorities (§ 34 para. 4 NISG 2026). A report in Austria does not automatically fulfill reporting obligations in other member states (BCS).

The notification updates the early warning where applicable and contains an initial assessment, including severity and impact, as well as indicators of compromise where available (§ 34 para. 2 no. 2 NISG 2026). According to the BCS, information from the early warning is carried over and can be updated; the notification can also be submitted only once.

If the significant incident affects the provision of your service, inform the recipients of your services without undue delay and, where possible, communicate any measures or remedies they can take in response (§ 34 para. 3 NISG 2026).

Model text, to be adapted to your case: “Dear Sir or Madam, on [MM/DD/YYYY] we detected a cybersecurity incident affecting [service]. [Scope] is affected. We have initiated [measures]. Please [measure for recipients]. Your contact person: [name, function, contact details]. We will update you again on [MM/DD/YYYY].”

If personal data is affected, the controller notifies the supervisory authority of the breach without undue delay and, where feasible, within 72 hours after having become aware of it, unless it is unlikely to result in a risk to the rights and freedoms of natural persons (Art. 33(1) GDPR). In Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde) under § 18 para. 1 DSG (Austrian Data Protection Act). According to the BCS, this obligation remains unaffected alongside the NIS2 report.

• Categories and approximate number of affected persons and records identified, risk to rights and freedoms assessed (Art. 33(1) and (3) GDPR); the breach is documented with facts, effects, and remedial action, even if there is no notification obligation (Art. 33(5)).
• Notification to the Data Protection Authority: nature of the breach, contact details of the data protection officer or another contact point, likely consequences, measures taken or proposed; after 72 hours, with reasons for the delay; provide missing information in phases (Art. 33(1), (3), and (4)).
• Likely high risk: affected persons notified without undue delay, unless an exception under Art. 34(3) applies (Art. 34(1)).
• As a processor: controller informed without undue delay (Art. 33(2)).

Pending, not applicable law: on November 19, 2025, the European Commission proposed a Digital Omnibus Regulation (COM(2025) 837). Under it, notification to the supervisory authority would only be required in the case of a likely high risk and, where feasible, within 96 hours, via a single entry point operated by ENISA. As of October 25, 2026, the proposal has not been adopted; Art. 33 GDPR applies unchanged.