A service fails at 8:00. The cause and scope are still unclear, and the case requires an internal handover by 10:00. Prepare it with confirmed information and open questions, and identify who makes the provisional decision.
In the course case, a service fails at 8:00. At 11:00 a second affected dataset is discovered. Update the classification and handover, record why the assessment changed, and add deputies and escalation routes. The resulting incident and reporting checklist can be adapted to your own process.
The times are exercise data. NIS2 applicability, competent authorities, reporting channels and deadlines depend on national implementation and require separate review.
What you will work on
Separate incident facts from unresolved assessment questions
Assign incident classification, reporting decisions and handovers to accountable roles
Incorporate new incident information into classification and handover
Who it is for
Information security officers
Crisis leaders
Compliance managers
Topics
Incident information and information quality
Classification and accountability
National reporting within the EU framework
Deputies and escalation
Decision records and reassessment
Your result
Your incident and reporting checklist covers information needs, responsibilities, deputies and an updated handover. Adapt the procedure for your own area.
Prerequisites
Basic knowledge of information security or incident management. An existing reporting process or an approved case description can provide the working basis; where access is unavailable, a case study replaces confidential material.
Format and approach
The asynchronous self-study course is planned for four to five hours. Make decisions as the case develops and check your work using explanations.
Two areas report the same recovery status. In one, the test worked but its record is missing; in the other, a plan exists but the test failed. Distinguish the gaps and record the tasks and dependencies for NIS2 implementation on an action board.
Work through a checklist for cybersecurity reports to your management body. Check which statements are supported by evidence, where information is missing and which follow-up actions are needed. Adapt the checklist to your organisation.
During a security incident at an energy utility, operations, IT/OT and management need to know who decides and when to involve others. Develop an incident plan for a supply area, including responsibilities and deputies, for discussion with management.