When the obligation to report an incident arises
Under the lower-obligation regime, the regulated service provider defines in advance which incidents it considers significant. The reporting obligation applies to incidents that meet this internally defined threshold.
The decision therefore does not begin in the NÚKIB Portal form. It begins with clear criteria, links to regulated services and the ability to quickly assess the actual impact on their provision.
The deadlines form one continuous process
Within 24 hours: an initial notification is submitted after a significant incident is identified. At this stage, speed matters more than complete technical detail.
Within 72 hours: a notification follows with updated information, impacts and available indicators of compromise. The deadline is shorter for trust services.
After resolution: the process concludes with a final report submitted within 30 days. If the incident continues longer, an interim status report also becomes part of the process.
What must be prepared in advance
The organisation needs to know the responsible person, the escalation method, the link to the governing body or authorised representative, and where it will maintain the timeline, measures taken and technical evidence.
Shieldora perspective
What this means in practice.
The greatest risk is not completing the report itself. It is the moment when the organisation cannot quickly decide whether an incident has crossed its significance threshold and who starts the statutory deadlines.
We therefore recommend linking incident classification to specific regulated services, defining a single moment when the clock starts and rehearsing responsibilities through a scenario exercise. Without this connection, even good guidance remains only a document.