Incident reporting: deadlines compared

How fast and to whom a cyber incident must be reported, in the main regimes worldwide, from the fastest to the slowest.

Data as of 2 November 2026Download the PDF

Always up-to-date version: https://www.cybersecuritydatabase.org/en/reports/incident-reporting/

The database compares 42 reporting regimes in 33 jurisdictions. In 35 cases the first notice is due within 24 hours, and 20 regimes require at least three successive reports.

First reporting deadline

Immediately7 regimes
Within 6 hours8 regimes
Within 24 hours20 regimes
Within 72 hours4 regimes
Over 72 hours2 regimes
As soon as possible1 regimes

All regimes, fastest first

Jurisdiction	Regime	Deadlines	Authority
Ecuador	Organic Law for the Strengthening of Cybersecurity (2026)	Immediately Incident notification 72 hours Maximum period for the notification	Ministry of Telecommunications and Information Society (MINTEL)
France	NIS1 (Law 2018-133)	Immediately Incident declaration	National Cybersecurity Agency of France (ANSSI)
Gabon	Law 027/2023 on cybersecurity and the fight against cybercrime	Immediately Declaration of the incident as soon as it becomes known	Competent administrative authority for cybersecurity
Malaysia	Cyber Security Act 2024 (Act 854)	Immediately Initial notification 6 hours First supplementary information 14 days Full details	Chief Executive of the National Cyber Security Agency (NACSA) and NCII sector lead
Mozambique	Law 13/2026 on CybersecurityNot yet operational	Immediately Cloud operators only: notice to the National CSIRT; for the others the Authority will set the deadline 1 month Monthly report on incident response and resolution	Sectoral CSIRT and National CSIRT; Autoridade Reguladora de Tecnologias de Informação e Comunicação (INTIC) as National Cybersecurity Authority
Nigeria	Cybercrimes Act 2015 (as amended in 2024)	Immediately Inform the National CERT 72 hours Reporting deadline	National Computer Emergency Response Team (CERT) Coordination Center, through the sectoral CERTs or Security Operations Centres (SOC)
Türkiye	Cyber Security Law No. 7545	Immediately Incident or vulnerability notification	Cyber Security Presidency (Siber Güvenlik Başkanlığı)
China	Measures for Reporting Cybersecurity Incidents (2025)	1 hour Critical infrastructure operators 2 hours Central and state bodies and their directly affiliated units 4 hours Other network operators 30 days Final report (from the end of incident handling)	Provincial cyberspace administration (CAC); for critical infrastructure the protection department and public security; for central and state bodies their own cyberspace unit
Italy	National cybersecurity perimeter (Decree-Law 105/2019)	1 hour Notification of the most serious incidents (category 2) 6 hours Notification of other incidents (category 1)	CSIRT Italia (National Cybersecurity Agency, ACN)
Taiwan	Cyber Security Management Act	1 hour Incident notification 36 hours Damage control or recovery completed and reported, for major incidents (72 hours for level 1 or 2 incidents) 1 month Investigation, handling and corrective action report (from completion of damage control or recovery)	Central competent authority in charge of the sector; for government agencies, the supervising agency and the Ministry of Digital Affairs
Singapore	Cybersecurity Act 2018	2 hours Incident notification 72 hours Supplementary details 30 days Final report (after the supplementary details)	Commissioner of Cybersecurity (Cyber Security Agency of Singapore)
Chile	Cybersecurity Framework Law 21.663	3 hours Early alert 72 hours Second report (24 hours for OIV whose essential service is affected) 7 days Action plan (OIV only) 15 days Final report (from the early alert)	National CSIRT (National Cybersecurity Agency, ANCI)
North Macedonia	Law on Security of Network and Information Systems (2025)	3 hours First notice of the significant incident or threat 24 hours Early warning 72 hours Incident notification 1 month Final report (from the notification)	Competent CSIRT (MKD-CIRT at the Agency for Electronic Communications or, for executive bodies, MKD-GOV-CSIRT)
European Union	DORA (EU) 2022/2554	4 hours Initial notification (from classification as major, no later than 24 hours from awareness) 72 hours Intermediate report (from the initial notification) 1 month Final report	Competent financial supervisory authority
India	CERT-In Directions of 28 April 2022	6 hours Incident report	Indian Computer Emergency Response Team (CERT-In)
Australia	Security of Critical Infrastructure Act 2018	12 hours Critical incident with significant impact (if oral, in writing within 84 hours) 72 hours Other incident with relevant impact (if oral, in writing within 48 hours)	Australian Cyber Security Centre (ASD's ACSC)
Hong Kong	Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653)	12 hours Notification of serious incidents (disrupting or likely to disrupt core functions) 48 hours Notification of other incidents 14 days Written report	Commissioner of Critical Infrastructure (Computer-system Security)
Armenia	Law on Cybersecurity (HO-442-N, 2025)	24 hours Incident notification (immediately and no later than 24 hours) 2 days Notice to potentially affected persons (immediately or, if not possible, within two days) 72 hours Update on severity and consequences 1 month Final report (one month after the update)	Information Systems Regulatory Commission
Switzerland	Information Security Act (ISA)	24 hours Cyberattack report	Federal Office for Cybersecurity (FOCS)
Germany	CRA (implementing bill)	24 hours Early warning (exploited vulnerability or severe incident) 72 hours Notification 14 days Final vulnerability report (from the fix) 1 month Final incident report (from the notification)	BSI (CSIRT), via ENISA's single reporting platform
Germany	NIS2 (NIS2UmsuCG, BSIG)	24 hours Early warning 72 hours Incident notification 1 month Final report (from the notification)	Federal Office for Information Security (BSI)
European Union	NIS2 Directive (EU) 2022/2555	24 hours Early warning 72 hours Incident notification 1 month Final report (from the notification)	National CSIRT or competent authority
European Union	Cyber Resilience Act (EU) 2024/2847: exploited vulnerabilities	24 hours Early warning of the actively exploited vulnerability 72 hours Vulnerability notification 14 days Final report (from when a corrective or mitigating measure is available) Without undue delay Inform the impacted users	CSIRT designated as coordinator in the Member State of main establishment, via ENISA's single reporting platform
European Union	Cyber Resilience Act (EU) 2024/2847: severe incidents	24 hours Early warning of the severe incident 72 hours Incident notification 1 month Final report (from the incident notification) Without undue delay Inform the impacted users	CSIRT designated as coordinator in the Member State of main establishment, via ENISA's single reporting platform
Finland	CRA (Act 439/2026)	24 hours Early warning (exploited vulnerability or severe incident) 72 hours Notification 14 days Final vulnerability report (from the fix) 1 month Final incident report (from the notification)	Traficom (NCSC-FI), via ENISA's single reporting platform
Ghana	Directive for the Protection of Critical Information Infrastructure (2021)	24 hours Incident report 72 hours Report of vulnerabilities found in audits and assessments (from discovery of the vulnerability)	Sectoral CERT or, where there is none, the National CERT (CERT-GH) of the Cyber Security Authority
Italy	CRA (draft legislative decree, AG 447)	24 hours Early warning (exploited vulnerability or severe incident) 72 hours Notification 14 days Final vulnerability report (from the fix) 1 month Final incident report (from the notification)	CSIRT Italia (ACN), via ENISA's single reporting platform
Italy	NIS2 (Legislative Decree 138/2024)	24 hours Early warning 72 hours Incident notification 1 month Final report (from the notification)	CSIRT Italia (National Cybersecurity Agency, ACN)
Italy	Law 90/2024 (public administrations)	24 hours Initial report 72 hours Full notification	National Cybersecurity Agency (ACN)
Kiribati	Cybersecurity Act 2026Not yet operational	24 hours All material information on the incident (from detection)	National CERT and the relevant sectoral CERT
Liechtenstein	NIS2 (Cyber Security Act, CSG)	24 hours Early warning 72 hours Incident notification 1 month Final report (from the notification)	Stabsstelle Cyber-Sicherheit (SCS)
Montenegro	Law on Information Security (2024)	24 hours Initial notification 72 hours First report on medium- or high-level incidents (from the initial notification) 30 days Final report (from resolution of the incident)	Cyber Security Agency or, for state administration bodies, the state administration CIRT
Norway	Digital Security Act (digitalsikkerhetsloven)	24 hours Notice (varsel) 72 hours Update of the notice 1 month Incident report (from the notice)	Sector supervisory authority, with a copy to the Norwegian National Security Authority (NSM)
Serbia	Law on Information Security (2025)	24 hours Incident notification 15 days Final report (from the end of the incident)	Single incident notification system (website of the competent ministry or of the Information Security Office); National Bank of Serbia, Securities Commission and RATEL for their sectors
United States	CIRCIA (2022)Not yet operational	24 hours Ransom payment (from the payment) 72 hours Covered cyber incident	Cybersecurity and Infrastructure Security Agency (CISA)
Peru	Digital Trust Framework Regulation (Supreme Decree 126-2025-PCM)	48 hours Notification of critical-level incidents	National Digital Security Centre (CNSD)
Australia	Cyber Security Act 2024 (ransomware payments)	72 hours Payment report (from the payment or from becoming aware of it)	Australian Signals Directorate (ASD)
Canada	Critical Cyber Systems Protection Act (S.C. 2026, c. 9)Not yet operational	72 hours Incident report to the CSE (maximum period; the exact one will be set by regulations)	Communications Security Establishment (CSE)
United Kingdom	NIS Regulations 2018	72 hours Incident notification	Sector competent authority; Information Commissioner's Office (ICO) for digital service providers
United States	SEC cybersecurity disclosure rules (Form 8-K, Item 1.05)	4 days Public disclosure on Form 8-K (4 business days from the materiality determination)	Securities and Exchange Commission (SEC)
Japan	Active Cyber Defense Act (Act No. 42 of 2025)	30 days Full report Without undue delay First report with the information available	Minister in charge of the business sector and Prime Minister
Spain	NIS1 (Royal Decree-Law 12/2018)	Without undue delay Initial notification, then updates and a final notification	Reference CSIRT (INCIBE-CERT, CCN-CERT or ESPDEF-CERT)