The Digital Omnibus package aimed to streamline cyber incident reporting across the EU. However, Ferma has raised concerns that member states' resistance to centralized reporting could lead to fragmentation. This could leave risk managers with overlapping and contradictory requirements instead of clarity.
If you're managing compliance for an entity covered by NIS2, DORA, or sector-specific cyber directives, you need a baseline checklist now. Before the regulatory landscape splinters further, document what you've built and where gaps remain. This checklist provides a clear done/not-done state for each requirement.
What This Checklist Covers
This isn't a policy coverage audit. It's a regulatory compliance checkpoint for cyber incident reporting under current EU frameworks. Use it to verify that your organization can meet mandatory disclosure timelines, maintain required documentation, and coordinate with competent authorities across jurisdictions. The checklist assumes you operate under NIS2 or equivalent sectoral rules and may face multiple reporting obligations.
Prerequisites
Before you work through the checklist, confirm:
- You've identified all applicable directives. Don't assume NIS2 is your only trigger. Financial entities face DORA requirements. Critical infrastructure operators may have national-level obligations layered on top of EU rules.
- You know your designated competent authority in each member state where you operate. This isn't always the same agency across borders.
- You have access to your incident detection and escalation procedures. If these exist only as draft documents or informal practices, document them formally before proceeding.
Checklist Items
1. Incident Classification Framework
You have a documented decision tree that maps detected events to reporting thresholds defined in your applicable directive.
Done means: A written matrix exists that defines "significant incident" based on criteria like affected user count, service downtime duration, data volume compromised, or potential impact on essential services. Your SOC or incident response team references this matrix during triage, and it's been reviewed by legal counsel within the past 12 months.
2. 24-Hour Early Warning Capability
Your team can submit an initial notification within 24 hours of detecting a significant incident, even with incomplete information.
Done means: You've tested the notification pathway to your competent authority. You have pre-drafted templates that capture required fields (incident start time, preliminary classification, affected services, initial containment actions). Your on-call roster includes at least two people authorized to submit this notification without waiting for executive approval.
3. 72-Hour Intermediate Report Process
You can produce an intermediate report within 72 hours that includes impact assessment, indicators of compromise, and preliminary root cause.
Done means: You've documented which internal teams contribute to this report (IT, legal, communications, business continuity) and established a review cycle that fits within the 72-hour window. You've confirmed that your incident response retainer or Breach Coach can support report drafting on this timeline.
4. Final Report Workflow
You have a process for delivering a final report within one month that includes lessons learned, remediation steps, and timeline reconstruction.
Done means: You've assigned ownership for final report compilation (typically the CISO or BCM lead). You've established a post-incident review meeting cadence that feeds into this report. Your legal team has reviewed at least one draft final report to confirm it meets regulatory content requirements without creating unnecessary legal exposure.
5. Cross-Border Notification Coordination
If you operate in multiple member states, you've mapped which incidents require notification to multiple competent authorities and how you'll coordinate submissions.
Done means: You maintain a current list of competent authorities by jurisdiction. You've documented whether you'll submit identical reports to each authority or tailor content based on local requirements. You've identified translation needs and confirmed turnaround times with your translation vendor.
6. Voluntary Reporting Threshold Guidance
Your team knows when to report incidents that fall below mandatory thresholds but could inform sector-wide threat intelligence.
Done means: You've documented criteria for voluntary reporting (for example: novel attack vectors, supply chain compromises affecting multiple customers, or incidents that nearly met the significance threshold). Your incident response plan includes a decision point for voluntary disclosure, and you've communicated this guidance to your SOC.
7. Supply Chain Incident Escalation
You have contractual language and operational procedures for receiving and escalating incident notifications from critical suppliers.
Done means: Your vendor risk assessments identify which suppliers handle data or services that could trigger your own reporting obligation if compromised. Your contracts require those suppliers to notify you within a specific timeframe. You've tested this notification pathway at least once through a tabletop exercise.
8. Insurer Notification Integration
Your incident response plan integrates regulatory reporting timelines with your Stand-Alone Cyber Policy's First Notice of Loss requirements.
Done means: You've compared your policy's notification deadline (often 24-72 hours) with regulatory deadlines and documented how you'll meet both. Your incident response runbook includes your broker's emergency contact and your policy's Insurer Consent Requirement for breach response vendors. You've confirmed that regulatory reports won't trigger Application Fraud Warranty concerns.
9. Documentation Retention
You retain incident records, forensic findings, and regulatory correspondence according to the longest applicable retention period.
Done means: You've documented retention requirements for each directive you're subject to (NIS2 typically requires five years). You've established a secure repository for incident documentation that's accessible to legal, compliance, and audit teams but protected from routine discovery. You've tested restoration of archived incident records at least once.
10. Competent Authority Contact Verification
You've verified contact details and submission portals for each competent authority you report to within the past six months.
Done means: You maintain a contact sheet with phone numbers, email addresses, and web portal URLs for each authority. You've confirmed these details are current (authorities reorganize, portals migrate). You've documented authentication credentials for any portals that require pre-registration.
Common Mistakes
Treating all incidents as reportable. Over-reporting creates noise and diverts resources from genuine compliance needs. Your classification framework should filter out events that don't meet significance thresholds.
Waiting for complete forensic findings before submitting the 24-hour notice. The early warning exists precisely because you won't have full information yet. Submit what you know and update in the 72-hour report.
Assuming one report satisfies all obligations. If you're subject to both NIS2 and DORA, or if you operate across multiple member states, you likely face distinct reporting requirements with different content expectations and timelines.
Ignoring the insurance intersection. Your insurer needs notification to reserve claims funds and may require consent before you engage breach response vendors. Regulatory deadlines don't excuse you from policy compliance.
Failing to document non-reportable incidents. Even if an event doesn't meet reporting thresholds, document it. Patterns of sub-threshold incidents can inform your risk assessment and may become relevant if a later incident escalates.
Next Steps
If you checked fewer than eight items as "done," prioritize closing those gaps before the Digital Omnibus fragmentation creates additional complexity. If member states proceed with separate reporting systems instead of a centralized approach, you'll face more obligations, not fewer.
Schedule a tabletop exercise that tests your 24-hour and 72-hour reporting capabilities. Invite legal, IT, communications, and your broker. Use a realistic scenario that triggers reporting in at least two jurisdictions.
Review your Stand-Alone Cyber Policy alongside this checklist. Confirm that your policy's Insurer Consent Requirement, Breach Coach access, and Business Interruption Coverage waiting periods align with the operational realities of meeting regulatory deadlines.
The opportunity for simplified EU cyber reporting may be slipping away. Your compliance posture shouldn't slip with it.
