What makes an incident "significant"
Article 23(3) of the NIS2 Directive calls an incident significant when it has caused or can cause severe operational disruption or financial loss for the entity, or considerable material or non-material damage to others. For eleven types of digital provider, Implementing Regulation (EU) 2024/2690 (in force since 7 November 2024) turns that into measurable criteria. Recital 30 says those criteria are exhaustive: if none is met, the incident is not significant for these entities. One criterion is enough.
General criteria for all eleven types (Art. 3 and 4)
- Financial loss (Art. 3(1)(a)): direct loss above EUR 500 000 or 5 % of last year's total annual turnover, whichever is lower. With EUR 4 million turnover the bar is EUR 200 000; from EUR 10 million turnover it is EUR 500 000.
- Trade secrets (b): exfiltration of trade secrets in the sense of Directive (EU) 2016/943.
- Death (c) or considerable damage to health (d) of a natural person.
- Malicious access (e): successful, suspectedly malicious and unauthorised access to network and information systems that can cause severe operational disruption.
- Recurring incidents (Art. 4): at least two incidents in six months with the same apparent root cause that together cross the financial threshold.
- Exclusion (Art. 3(2)): scheduled interruptions and planned consequences of scheduled maintenance are never significant.
Entity-specific thresholds (Art. 5-14)
| Entity | Complete outage | Limited availability | Data compromise |
|---|---|---|---|
| DNS (Art. 5) | > 30 min | Average response > 10 s for > 1 h | Any CIA compromise of authoritative resolution data, except misconfiguration of < 1 000 domains and ≤ 1 % of managed domains |
| TLD registry (Art. 6) | Any duration | Average response > 10 s for > 1 h | Any CIA compromise of data for the technical operation of the TLD |
| Cloud (Art. 7), CDN (Art. 9), MSP / MSSP (Art. 10) | > 30 min | > 5 % of EU users or > 1 million (smaller number), for > 1 h | Suspectedly malicious, or affecting > 5 % of EU users or > 1 million |
| Data centre (Art. 8) | Any duration | > 1 h | Suspectedly malicious; or physical access to the data centre compromised |
| Online marketplace, search engine, social network (Art. 11-13) | For > 5 % of EU users or > 1 million | > 5 % of EU users or > 1 million affected | Suspectedly malicious, or affecting > 5 % of EU users or > 1 million |
| Trust service (Art. 14) | > 20 min, or > 1 h per calendar week | > 1 % of EU users or relying parties, or > 200 000 | Affecting > 0.1 % of users or relying parties, or > 100; or physical access to restricted areas compromised |
CIA = integrity, confidentiality or authenticity of stored, transmitted or processed data. "Whichever is smaller" means the percentage wins for smaller services: a cloud service with 200 000 EU users crosses the line at 10 001 affected users. All comparisons are "more than", so exactly 30 minutes or exactly 5 % does not meet the criterion.
How to measure
- Users (Art. 3(3)): customers with a contract giving access to the service, plus the people and organisations associated with business customers. Cannot count? Use your estimate of the possible maximum (recital 32).
- Duration (recitals 34-35): from the disruption of proper service until recovery. If you do not know when it began, from detection or the first log entry, whichever is earlier.
- Limited availability (recital 38): considerably slower than average response times, or not all functionalities available, such as a chat or image search function.
- Financial loss (recital 36): replacement of hardware and software, staff and overtime, contractual penalties, customer redress, forgone revenue, communication, legal, forensic and remediation costs. Not administrative fines, routine maintenance, post-incident upgrades or insurance premiums. Estimate where you cannot measure yet.
Once it is significant
The NIS2 clock runs from the moment you become aware of the significant incident, which recital 31 places at the point where your initial assessment gives a reasonable degree of certainty. Then: early warning within 24 hours, incident notification within 72 hours (24 hours for trust service providers), final report one month after the notification. Use the breach deadline calculator to get the exact times, and check whether the same incident is also a GDPR personal data breach.
Not legal advice. The checker applies the published text of Regulation 2024/2690 to your answers. Your competent authority or CSIRT can take a different view, and national law may add sector-specific reporting.
Primary sources
- Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, Arts. 3-14 and recitals 30-40
- Directive (EU) 2022/2555 (NIS2), Art. 23