Incident Reporting Readiness for NIS2 or DORA

Many organisations fail not because of the incident itself but because of a lack of preparation for handling it and meeting reporting deadlines. NIS2 and DORA impose specific obligations: an initial notification (24h), a detailed report (72h) and a final report (within 30 days).

We prepare the organisation to respond in a structured, documented manner that meets regulatory requirements - so that in a crisis you can act quickly, calmly and in line with your obligations to the regulator.

What we implement

• An incident response procedure (IRP) with a RACI matrix
• A 24h / 72h / 30-day reporting scenario
• Notification forms and communication templates (board, regulator, clients, media)
• A tabletop exercise (dry-run notification)
• A minimal evidence package for audit purposes

Who is it for

• Organisations covered by NIS2 or DORA
• Companies in the supply chain of larger entities
• IT and outsourcing, manufacturing, healthcare, logistics, water supply, infrastructure

The service provides the organisation with a structured response and reporting process compliant with current regulatory requirements.