The selected Security Operations Center of an organization should establish and document a clear process for reporting minor cyber incidents to the National Cyber Security Centre (NKSC).
Notifications to the NKSC are to be done according to the descriptions below.
Notification of disruption (at the latest within 72 hours of detecting the disruption)
- is the cause suspected to be illegal activities
- can the disruption have effects on other countries
- the current assessment of the disturbance, its severity and effects is given
- possible evidence of the leakage is listed
Final report (at the latest within 1 month of the incident report)
- a detailed description of the incident, including its severity and effects
- type of threat or root cause that likely triggered the event
- applied and ongoing mitigation measures
- potential impact on other countries
In the case where notification of disruption contains all the information of the final report, a final report is not required.
.svg)
