NIS2 Implementing Regulation

(30) This Regulation is to further specify the cases in which an incident should be considered to be significant for the purpose of Article 23(3) of NIS2 Directive (Network and Information Security). The criteria should be such that relevant entities are able to assess whether an incident is significant, in order to notify the incident in accordance with NIS2 Directive (Network and Information Security). Furthermore, the criteria set out in this Regulation should be considered exhaustive, without prejudice to Article 5 of NIS2 Directive (Network and Information Security). This regulation specifies the cases in which an incident should be considered to be significant by setting out horizontal as well as entity-type specific cases.