The Clock Is Ticking, the Evidence Isn’t: What Incident-Reporting Laws Like NIS2 Actually Require

Introduction A significant cyber incident hits at 11pm on a Friday. Under NIS2, the clock on the first regulatory deadline starts the moment the organisation becomes aware of it, not the moment someone gets around to writing the notification. Twenty-four hours later, a national authority expects an early warning.