The organization informs the authority defined in the legislation (CSIRT) without delay about disturbances that have significantly affected the provision of its services.
A disturbance is significant when at least one of the following occurs:
- disruption may cause serious disruption in the operation of services or serious financial losses for the service provider
- disruption may cause significant material or immaterial damage to related people or other organizations
Notifications are to be done step by step according to the descriptions below. In addition, while the disruption is ongoing, the organization must deliver the status updates requested by the authority.
Early warning (at the latest within 24 hours of detecting the disruption)
- is the cause suspected to be illegal activities
- can the disruption have effects on other countries
More detailed notification of disruption (within 72 hours of the disruption at the latest detection)
- previous information is updated
- the current assessment of the disturbance, its severity and effects is given
- possible evidence of the leakage is listed
Final report (at the latest within 1 month of the incident report)
- a detailed description of the incident, including its severity and effects
- type of threat or root cause that likely triggered the event
- applied and ongoing mitigation measures
- potential impact on other countries
