CloudSignLab
Sign inStart free

Help centerRegisters and records

Report and handle an incident

Record a security incident at once, follow the NIS2 reporting clock and note when each report was sent.

Updated September 29, 2026

In this section: Registers and records

When something goes wrong, such as a phishing email that worked, a lost laptop or an outage, record it in Incidents straight away. For NIS2 the reporting clock starts when you become aware of an incident, not when you finish investigating it.

How to report an incident

  1. Open Incidents in the menu, then Report incident.
  2. Give the Incident a short name and describe What happened. Choose the Type, Severity and Status, and who it is Handled by.
  3. Check Became aware at: the NIS2 clock starts at this moment. Add Started at (if known).
  4. Tick Significant incident (NIS2) if it severely disrupts your services, causes financial loss or considerable damage to others. Tick Personal data affected if personal data is involved.
  5. Click Save incident. It gets a number such as INC-4, and the owners, admins and the person handling it are notified.

The NIS2 reporting clock

For a significant incident, the incident page shows the Reporting clock with three deadlines:

  • Early warning (24 hours) after you became aware.
  • Incident notification (72 hours) after you became aware.
  • Final report (1 month) after the notification was sent.

If personal data is affected, it also shows the date by which to check whether the data protection authority must be told (GDPR, 72 hours).

You send the reports to your CSIRT or authority yourself; CloudSignLab does not send them. Afterwards, enter the dates in Early warning sent, Notification sent and Final report sent, and the CSIRT or authority case number.

While you handle it

  • Move the Status from Open to Investigating, Contained, Resolved and Closed, and write down the Impact and the Measures taken.
  • Add screenshots or logs in Evidence and choose the incident under Incident it documents.
  • Reports due next at the top of Incidents lists the next report of each significant incident, soonest first. Open reports also appear in Tasks as Incident report.

Tips

  • Every member can report and see incidents. Changing and deleting them needs an owner or admin (or a custom role with that permission).
  • The owners, admins and the person handling it are reminded once 6 hours before the early warning, 12 hours before the notification and 5 days before the final report is due.
  • Every package includes unlimited incidents, so you can always record one.

See also

Report and handle an incident | CloudSignLab