Article 23c – Harmonising incident notification framework

By [6 months after the entry into force of this Regulation] the Commission shall submit a report to the European Parliament and to the Council outlining common elements and differences in definitions, thresholds, deadlines, formats and procedures applying to Article 23 of Directive (EU) 2022/2555, Article 19a (1a), Article 24 (2a) and Article 45a (3a) of Regulation (EU) 910/2014, Article 33 (1) of Regulation (EU) 2016/679, Article 19 (1) and (2) of Regulation (EU) 2022/2554, and Article 15(1) of Directive (EU) 2022/2557.

The report shall in particular consider concrete steps and a timeline for further harmonisation efforts on incident reporting under the Union legal acts.

Building on the report referred in paragraph (1), ENISA shall, in cooperation with the CSIRTs network, the Cooperation Group and competent authorities under the relevant Union legal acts, and other relevant bodies or groups established at Union level under relevant Union legal acts, develop guidelines for further harmonisation on incident notifications. These guidelines shall, in particular:

Identify ways to further harmonise templates for entities but also between CSIRTs across different sectors and legislative frameworks;

Provide a thorough analysis on the different sectoral thresholds, and, where appropriate, provide suggestions with regards to possible harmonization to improve efficiency;

Review the stages of incident notifications under different Union legal acts and recommend measures to streamline the process for entities.

ENISA shall present to the Commission and Council a first draft of these guidelines [by - within 12 months after the entry into force of this Regulation], and a final version within 18 months, and shall update them regularly thereafter.