Under NIS2, a significant incident starts three clocks: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report within one month of that notification. In Romania the directive is transposed by Government Emergency Ordinance 155/2024, approved by Law 124/2025, and reports go to the National Cyber Security Directorate (DNSC).
The clock starts at awareness, not at certainty
The 24-hour window opens when you become aware of a significant incident, not when the investigation is finished. The early warning is deliberately short: whether the incident is suspected to be caused by unlawful or malicious acts, and whether it could have a cross-border impact. Waiting for the full picture is the most common way to miss it.
Decide in advance what significant means
NIS2 treats an incident as significant when it has caused, or can cause, severe operational disruption or financial loss, or considerable damage to others. Turn that into criteria your SOC can apply at three in the morning: affected services, number of users, duration, data involved. Put them in the triage playbook, not in a policy nobody opens during an incident.
Build the report into the playbook
- Name who decides that an incident is significant, and who sends the early warning.
- Keep pre-approved templates for each of the three reports.
- Log every decision with a timestamp: the timeline is part of what you report.
- Rehearse it. A tabletop exercise that ends with a test early warning shows where the hours actually go.
The aim is for reporting to become a step of incident response, carried out by the people who already know the facts, rather than a separate task that starts when everyone is busy containing the incident.