Article 23c – Harmonising incident notification framework

By [6 months after the entry into force of this Regulation] the Commission shall submit a report to the European Parliament and to the Council outlining common definitions, thresholds, deadlines, formats and procedures applying to Article 23 of Directive (EU) 2022/2555, Article 19a (1a), Article 24 (2a) and Article 45a (3a) of Regulation (EU) 910/2014, Article 33 (1) of Regulation (EU) 2016/679, Article 19 (1) and (2) of Regulation (EU) 2022/2554, and Article 15(1) of Directive (EU) 2022/2557. The report shall in particular consider concrete steps and a timeline for introducing the unified approach to incident reporting under the Union legal acts.

Building on the report referred in paragraph (1), ENISA shall, in consultation with the CSIRTs network, the Cooperation Group and competent authorities under the relevant Union legal acts, develop guidelines to foster the harmonization of incident notifications. These guidelines shall, in particular: (a) Identify ways to further harmonise templates for entities but also between CSIRTs across different sectors and legislative frameworks; (b) Provide a thorough analysis on the different sectoral thresholds, and, where appropriate, provide suggestions with regards to possible harmonization to improve efficiency; (c) Review the stages of incident notifications under different Union legal acts and recommend measures to streamline the process for entities. ENISA shall present a first draft of these guidelines [by - within 12 months after the entry into force of this Regulation], and a final version within 18 months, and shall update them regularly thereafter.