§ 32 BSIG: the duty to report significant security incidents
§ 32 BSIG requires essential and important entities to report significant security incidents: an early warning within 24 hours, an incident notification within 72 hours and a final report one month after the notification. The deadlines run from the moment you become aware of the incident. You report in the BSI portal.
The three reports
Reports go to the joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK).
Early warning
Whether the incident is suspected to come from an unlawful or malicious act, and whether it could have effects in other countries. The German law calls this the “frühe Erstmeldung”.
§ 32(1) no. 1
Incident notification
Confirms or updates the early warning. Adds a first assessment of severity and impact and, where available, signs of the attackers (indicators of compromise).
§ 32(1) no. 2
Final report
One month after the notification: what happened, how serious it was, the likely cause, what you have done and are doing, and whether other countries are affected.
§ 32(1) no. 4
If the BSI asks, you send an intermediate report in between (no. 3). If the incident is still ongoing after a month, you send a progress report instead of the final report, and the final report once it is dealt with (subsection 2).
The reporting duty step by stepWhen an incident is significant
A security incident is significant if it has caused or can cause severe disruption to your operations or financial loss for your company. Or if it has caused or can cause considerable material or non-material damage to others.
For certain digital providers, such as cloud, data centres and managed services, Implementing Regulation (EU) 2024/2690 sets more precise thresholds. For everyone else there are no fixed figures. You decide on these two criteria and record why.
§ 2 no. 11 BSIG · Art. 23(3) NIS 2
When the clock starts, and where you report
The deadlines run from awareness, not from when everything is clear. The BSI takes awareness to mean the moment someone in the company learns of the incident during working hours.
You report in the BSI portal, with the same login as for registration. If you are not registered yet, you report through an online form in the BSI's reporting and information portal (MIP).
If personal data is affected, you usually also report to the data protection authority: without undue delay and where feasible within 72 hours, unless the breach is unlikely to result in a risk to the people concerned (Art. 33 GDPR). One report does not replace the other.
§ 32(1) BSIG · Art. 33 GDPR
What else the section covers
Subsection 3: operators of critical facilities also state which facility is affected and what the incident means for their critical service.
Subsection 4: the BSI sets the details of the procedure and the content and publishes them on its website.
Subsection 5: the BSI passes reports on to the competent federal supervisory authorities.
Subsection 6: the BSI can offer you support in handling the incident.
What this means for a company with 50 to 150 employees
Decide beforehand who judges whether an incident is significant and who reports. In an emergency there is little time for that.
Check that this person can sign in to the BSI portal today, and who stands in for them. If only one person holds the login, the 24 hours get tight quickly.
An example
A made-up company: a food wholesaler with 95 employees. Friday, 4 p.m.: the warehouse software fails, and the lorries cannot be loaded.
4.30 p.m.: IT finds that the servers are encrypted. From now on the clock is running.
5 p.m.: under the incident response plan, the managing director decides. He classifies the incident as significant because operations are severely disrupted.
8 p.m.: the early warning in the BSI portal. It says that an attack is suspected and that customers in Austria could be affected. The deadline would have run until Saturday, 4.30 p.m.
By Monday, 4.30 p.m. at the latest: the incident notification with a first assessment of severity and impact.
One month after that notification: the final report, or a progress report if the incident is still ongoing. Alongside this, the company checks whether personal data is affected.
How the walkthrough does this
Two steps in the walkthrough at nisd2.eu prepare you for reporting.
"Plan what happens in an incident": your answers produce your incident response plan. It says who decides and how you report.
"Know how to report an incident": the step shows the three deadlines and an example of an early warning.
You record whether you can sign in to the BSI's portal and report.
At the end, management approves the incident response plan in the app.
Common questions
When does the 24 hour deadline start?
From the moment your company becomes aware of the significant incident, not from when it began. The BSI takes this to mean the moment someone in the company learns of it during working hours.
What goes into the early warning?
The law asks for two things: whether an attack or another unlawful act could be behind it, and whether the incident could affect other countries (§ 32(1) no. 1 BSIG). What you do not know yet, you add in the notification after 72 hours.
Are there fixed thresholds for a significant incident?
Only for the digital providers named in Implementing Regulation (EU) 2024/2690. For everyone else, the criteria in § 2 no. 11 BSIG apply: severe operational disruption, financial loss or considerable damage to others.
Do I also have to report under the GDPR?
If personal data is affected, usually yes: to the data protection authority, where feasible within 72 hours (Art. 33 GDPR). The report to the BSI does not replace it.
Where do I report?
In the BSI portal, with the login from registration. If you are not registered yet, use the online form in the BSI's reporting and information portal.
Sources
- BSI Act (BSIG) § 2 no. 11 and § 32, gesetze-im-internet.de/bsig_2025
- Directive (EU) 2022/2555 (NIS 2), Art. 23, EUR-Lex
- Implementing Regulation (EU) 2024/2690, EUR-Lex
- BSI: NIS 2 reporting information pack and guide to reporting in the BSI portal, bsi.bund.de
- Regulation (EU) 2016/679 (GDPR), Art. 33
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
Incident Handling
Know how to report an incident
Three reports to your authority, with fixed deadlines.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
