# Security incident reporting clocks

Use this when you are building, or testing, an incident management plan. Each clock below is set by a
law or rule, read on 20 October 2026. Which ones apply depends on where you operate and what you are.
It is a planning list, not legal advice.

## Before anything happens

- [ ] Which of the rules below apply to the organization, decided and written down: ____________
- [ ] Who decides whether an incident is significant or material, by name: ____________
- [ ] Who files each report, and through which portal or authority: ____________
- [ ] A tested contact list for the authority, the board and the communications lead

## NIS2, Directive (EU) 2022/2555, Article 23 (significant incidents)

- [ ] Early warning to the CSIRT or competent authority within 24 hours of becoming aware
- [ ] Incident notification within 72 hours of becoming aware
- [ ] Final report within one month of the incident notification
- [ ] Management body has approved the cybersecurity risk-management measures (Article 20)
- [ ] Management body members have followed training (Article 20)

## US SEC, Form 8-K Item 1.05 (public companies, material incidents)

- [ ] Materiality decided without unreasonable delay after discovery
- [ ] Form 8-K filed generally within four business days of deciding an incident is material
- [ ] Annual report describes the cybersecurity risk process, the board's oversight, and management's
      role and expertise (Regulation S-K Item 106)

## DORA, Regulation (EU) 2022/2554 (EU financial entities)

- [ ] Major ICT-related incident classification and reporting procedure in place
- [ ] Reporting deadlines checked against the current regulatory technical standards

## After every incident or exercise

- [ ] Timeline of decisions, with who decided and when
- [ ] Lessons learned recorded and assigned an owner
- [ ] Plan updated and the change approved