One of the most fundamental changes introduced by the amendment to the Act on the National Cybersecurity System (NCS) is a rigorous, three-stage reporting regime for serious incidents. The EU NIS2 directive emphasizes a system of precise deadlines. For key and important entities, this requires the implementation and application of rigorous response procedures.
When does an incident become serious?
Businesses are not required to report every minor IT incident. Mandatory reporting applies to major incidents, meaning events that cause or have the potential to cause significant disruptions in service provision, result in significant financial losses for the organization, or inflict significant material or non-material damage on other entities.
Crucially, the 24-hour time limit for initial response begins from the moment the organization detects the incident, not from the completion of post-intrusion analysis. Importantly, the time limits also apply to Saturdays, Sundays, and other public holidays.
Three stages of reporting: 24 hours, 72 hours and 1 month
The new KSC regulations divide the process of informing the authorities into three precisely defined steps:
- Up to 24 hours – Early Warning: Within 24 hours of detecting an incident, the entity submits preliminary information to the appropriate CSIRT. This notification aims to determine whether the incident was caused by illegal or malicious activity and whether it may have cross-border implications.
- Up to 72 hours – Full incident report: Updates must be submitted within this timeframe. The report includes a preliminary assessment of the incident's severity, potential impacts, indicators of compromise (IoCs), and remediation measures taken to date.
- Within 1 month – Final Report: Once the incident has been resolved (or within one month of full reporting), the entity submits a detailed report. This includes a root cause analysis, final loss assessment, implemented long-term preventative measures, and lessons learned. If the incident has taken longer than a month to resolve, a progress report is submitted.
Parallel paths: KSC, GDPR and DORA
A cyberattack is rarely limited to a single legal regime. If the incident involves a breach of personal data protection (e.g., a customer database leak resulting from a ransomware attack), the organization must fulfill two independent obligations: reporting to the appropriate CSIRT under the KSC and notifying the Personal Data Protection Office (UODO) within 72 hours under the GDPR. For financial sector entities, these requirements are additionally met by the DORA regulation.
How to prepare an organization for time pressure?
To comply with legal requirements, organizations should complete the following steps:
- Develop and test an IR Playbook: Create a clear incident response scenario defining the roles of the IT team, management, legal and communications departments.
- Establishing contact points and reporting channels: Test access to the S46 system and the relevant CSIRT forms before a real threat occurs.
- Event Classification Criteria: Implement internal indicators that allow IT administrators to immediately distinguish a common incident from a serious incident.
- Informing service recipients: Remember to immediately notify customers if a cyber threat may affect the services provided to them.
In summary, the new incident reporting regime at the KSC forces a shift from declarative security to genuine operational readiness. The regulator does not penalize a company for the mere occurrence of an attack on the organization, but rather for failure to detect threats, communication disruptions, and exceeding statutory deadlines. A well-functioning incident reporting procedure is now the most important shield protecting management from accusations of a lack of due diligence in risk management. With the 2026 report in place, it's worth verifying the authority of representatives, preparing technical data, and designating responsible contact points.
This article is for informational purposes only and does not constitute legal advice.
The law is current as of August 27, 2026.
