Several reporting duties may apply to the same incident, each with its own clock. NIS2 asks for an early warning within 24 hours. GDPR requires notifying the data protection authority within 72 hours. DORA has its own timelines for financial entities.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- Check which regimes apply to you
- Assign one person to track every clock
- Use templates for each report
Next steps
Late reports are a common finding after an incident. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.