Significant incidents must be reported in stages: an early warning within 24 hours, a notification within 72 hours and a final report within a month. The clock starts when you become aware of a significant incident, not when the investigation is complete. The first report can be short and preliminary.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- Define what significant means for your services
- Name who decides to report and who sends the report
- Prepare templates so the first report takes minutes, not hours
Next steps
Practise the clock in a tabletop exercise. Most teams find the 24-hour step harder than expected. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.