Home / NIS2 & CIRCIA

NIS2 & CIRCIA: report on time, from evidence

When a significant cyber incident hits, the reporting clock starts at once. Here is what NIS2 and CIRCIA ask for, and how Tracknosis gives you the facts each report needs from your Windows machines.

NIS2 CIRCIA Other reporting rules Around the world How Tracknosis helps Free templates

General information, not legal advice. National NIS2 laws add their own detail, and the CIRCIA final rule is not yet in force. Check what applies to your organisation with your legal or compliance team. Current as of October 2026.

EU · in force

NIS2

NIS2 applies to medium and large organisations in a wide range of sectors, from energy, transport and health to digital infrastructure, public administration and manufacturing. Organisations are classed as essential or important entities, and both must report significant incidents to their national CSIRT or authority.

24 hEarly warning. Is the incident suspected to be malicious, and could it have a cross-border impact?
72 hIncident notification. An initial assessment, including severity and impact, and indicators of compromise where available.
On requestIntermediate report. Status updates if the CSIRT or authority asks.
1 monthFinal report. A detailed description, the likely root cause, the measures taken and any cross-border impact. If the incident is still ongoing, a progress report first.

Management is accountable. Management bodies must approve and oversee cyber risk measures and can be held liable for failures. Fines can reach €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important entities.

Three reporting clocks, 24 hours, 72 hours and one month, beside an incident report draft built from collected evidence
US · coming soon

CIRCIA

The Cyber Incident Reporting for Critical Infrastructure Act requires covered critical-infrastructure organisations to report to CISA. The deadlines are set in the law; the final rule decides exactly who is covered and what reports must contain. It was sent for White House review in October 2026 and takes effect after publication.

72 hCovered cyber incident, within 72 hours of reasonably believing it occurred.
24 hRansom payment, within 24 hours of making it.
OngoingSupplemental reports when substantial new or different information becomes available, and preservation of data relating to the incident.
Other clocks

The same pattern, in more rules

Most reporting rules follow the same shape: an early warning within hours, a fuller notification within about 72 hours, and a final root-cause report within about a month. One incident can start several clocks at once.

DORAEU financial sector · in force

Initial notice within 4h of classifying a major incident, intermediate report within 72h, final report within one month.

UK GDPRUK · in force

Personal data breaches reported to the ICO within 72h of becoming aware.

SEC cyber ruleUS listed companies · in force

Material cyber incidents disclosed within four business days of deciding they are material.

UK Cyber Security and Resilience BillUK · in Parliament

Proposed 24h initial notification and 72h full report to the regulator and the NCSC.

Around the world

NIS2, CIRCIA and similar rules around the world

National laws that require critical or essential organisations to report cyber incidents to the government. The US has no single rule in force yet, so its main critical-infrastructure sector rules are listed. Privacy breach rules and finance-only rules are not included.

CountryRuleStatusWho it coversReporting deadlines
European UnionNIS2 DirectiveIn forceEssential and important entities in 18 sectors, in every EU member state24 h early warning, 72 h notification, final report within 1 month
United KingdomNIS Regulations 2018In forceOperators of essential services (energy, transport, health, water, digital infrastructure) and digital service providers72 h to the competent authority
United KingdomCyber Security and Resilience BillIn ParliamentReplaces and expands NIS: adds managed service providers, data centres and critical suppliersProposed 24 h initial notification to the regulator and the NCSC, then a full report within 72 h
SwitzerlandInformation Security ActIn force (April 2025)Critical infrastructure operators, including energy, water, transport and public administrations24 h to the National Cyber Security Centre, then complete the report within 14 days
United StatesCIRCIA (Cyber Incident Reporting for Critical Infrastructure Act)Law; final rule under White House reviewCovered critical infrastructure organisations across 16 sectors72 h for covered cyber incidents and 24 h for ransom payments, to CISA
United StatesTSA Security DirectivesIn forcePipelines, freight and passenger rail, and aviation24 h to CISA
United StatesNERC CIP-008In forceOwners and operators of the bulk electricity grid1 h for reportable incidents; attempted compromises by the end of the next calendar day, to E-ISAC and CISA
United StatesDFARS 252.204-7012In forceDefence contractors handling controlled defence information72 h to the Department of Defense (DC3)
CanadaCritical Cyber Systems Protection Act (Bill C-8)Law since June 2026, not yet in forceDesignated operators in telecoms, energy, banking, transport and nuclearWithin a period set by regulation, no more than 72 h, to the Communications Security Establishment
BrazilCybersecurity Legal Framework (Bill 4752/2025)ProposedCritical infrastructure and essential servicesMandatory incident reporting proposed; deadlines not yet set
AustraliaSecurity of Critical Infrastructure (SOCI) ActIn forceCritical infrastructure assets in 11 sectors12 h for incidents with a significant impact; 72 h for other relevant impact, to the Australian Signals Directorate
AustraliaCyber Security Act 2024In force (May 2025)Businesses with turnover above A$3M, and all critical infrastructureRansomware or extortion payments within 72 h of paying
SingaporeCybersecurity Act (amended 2024)In force (amendments Oct 2025)Owners of critical information infrastructure2 h initial notification to the Cyber Security Agency, then a detailed report within 14 days
IndiaCERT-In Directions 2022In forceAlmost all organisations: service providers, data centres, companies and government bodies6 h to CERT-In
ChinaNational Cybersecurity Incident Reporting MeasuresIn force (Nov 2025)All network operators, stricter for critical information infrastructure4 h for reportable incidents; 1 h where critical information infrastructure is involved
JapanActive Cyber Defence ActIn force (Oct 2026)258 critical infrastructure operators in 15 sectorsPreliminary report as soon as possible for DDoS, within 3–5 days for ransomware and other attacks; detailed report within 30 days
South KoreaInformation and Communications Network Act (amended)In force (Aug 2024)Information and communications service providers24 h to the Ministry of Science and ICT or KISA, with updates within 24 h of confirming new details
New ZealandCritical infrastructure cyber security regimeProposedCritical infrastructure entitiesProposed 24 h early warning, then a full report within 72 h
Saudi ArabiaNCA cybersecurity controls (ECC, and NCNICC for the private sector)In forceGovernment bodies, critical national infrastructure and, increasingly, private-sector companiesIncidents reported to the National Cybersecurity Authority, within the timeframes set in NCA requirements
South AfricaCybercrimes Act, section 54Law, reporting duty not yet in forceElectronic communications service providers and financial institutionsWhere feasible within 72 h, to the South African Police Service

General information, not legal advice; rules and dates change, so confirm with the official source or your legal team. The fastest clocks: 1 h (US electricity grid; China, critical infrastructure), 2 h (Singapore), 6 h (India), 12 h (Australia).

How Tracknosis helps

Every report asks for facts. Tracknosis has them.

Teams rarely struggle to write the report. They struggle to establish what actually happened on their machines in time. Here is what each report needs, and what Tracknosis provides on Windows.

The report asksWhat Tracknosis provides
Which systems are affected?Every file and registry change on each scanned machine, rated High, Medium or Low, so affected machines stand out
Is it malicious?Signs of attack and tampering: new auto-starts linked to unsigned or downloaded files, faked timestamps, cleared event logs, switched-off auditing
Indicators of compromiseThe specific files, registry keys, auto-starts and services added or changed, with paths, times and signatures
When did it start?Scan-by-scan history, so you can see the first scan where the changes appear
Root causeThe changes made before the incident, compared against an earlier baseline
Measures takenA rescan after clean-up confirms what was removed, and that the foothold is gone
Preserve the evidenceRead-only collection, each scan stamped with machine, volume, tool version, operator and time; recovered files written to a different volume
Write the reportAn AI report draft for NIS2 or CIRCIA built from the evidence, for your team to review and complete

The key is having a baseline before the incident. Tracknosis can only show what changed since the scans it has taken, so start before you need it.

Free resources

Get ready before the clock starts

Free report templates for every NIS2 and CIRCIA stage, and a readiness checklist covering what to prepare before an incident.

Get the free report templates   View the checklist   Download the PDF

Further reading: NIS2 and CIRCIA: what the 24- and 72-hour clocks demand · AI-drafted incident reports, done responsibly

Have the evidence before the clock starts

Request a guided trial: we install Tracknosis with you on one of your Windows machines and walk you through your first results, so you have a baseline before you need it. Free, and nothing stays installed unless you choose to continue.

Request a guided trial   Talk to us first