The organization must notify to the Danish Energy Agency without delay about disturbances that have significantly affected the provision of its services. The CSIRT must also be notified if an incident compromises the security of network and information systems, while Energinet must be notified of incidents affecting the electricity, gas, and hydrogen sectors.
All notifications must be submitted through the competent authority's designated digital solution. Specifically, cyber-related incidents must follow the CSIRT-specified process, while all other significant incidents must follow the Danish Energy Agency's designated process.
A disturbance is significant when at least one of the following occurs:
- disruption may cause serious operational disruptions to the company's services, including due to plant failures, labor disputes, or lack of deliveries crucial for society's energy supply
- disruption may cause serious financial losses for the affected company
- disruption may cause significant material or immaterial damage to related people or other organizations
- disruptions require activating the company's contingency plans, such as when a network or information system's confidentiality, integrity, availability, or authenticity is compromised
- disruption involves a reasonable suspicion or knowledge of intrusion, theft, sabotage, or espionage
- disruption requires external assistance for situation assessment, remediation, or recovery of the company's network and information systems
Notifications are to be done step by step according to the descriptions below. In addition, while the disruption is ongoing, the organization must deliver preliminary report of relevant status updates requested by the authority.
Early warning (at the latest within 24 hours of detecting the disruption)
- what kind of incident it was, its cause, and how it unfolded
- is the cause suspected to be illegal activities
- can the disruption have effects on other countries
Status notification of disruption (within 72 hours of the disruption at the latest detection)
- previous information is updated
- the current assessment of the disturbance, its severity and effects is given
- possible evidence of the leakage is listed
Final report (at the latest within 1 month of the incident report)
- a detailed description of the incident, including its severity and effects
- number of users affected, the percentage of total users this represents, and how long the service was down
- geographical areas that were impacted
- type of threat or root cause that likely triggered the event
- applied and ongoing mitigation measures
- potential impact on other countries
- description of collaboration with external parties
- summary of experiences and lessons learned from the incident, along with the planned follow-up actions and their timeline
.svg)
