Is incident response mandatory?

Using an incident response provider is not mandatory in itself. However, several laws provide for incident handling and reporting: NIS2 (Articles 21 and 23) for regulated entities, the GDPR (Articles 32 to 34) whenever personal data is involved, and DORA for the financial sector. In practice, these duties assume a response capability, whether in-house or outsourced.

This article is part of our incident response series. For the full picture, see What is incident response?.

What each law provides

Law	Who it covers	What the text provides	Deadlines
NIS2, Article 21	Essential and important entities	Incident handling, business continuity and crisis management measures	No deadline set by the article
NIS2, Article 23	Same entities	Reporting of significant incidents	Early warning within 24h, notification within 72h, final report within one month
GDPR, Article 32	All controllers and processors	Security appropriate to the risk, including the ability to restore access to data after an incident	No fixed deadline
GDPR, Article 33	All controllers	Notification to the supervisory authority of breaches posing a risk; documentation of every breach	72 hours after becoming aware
GDPR, Article 34	All controllers	Informing individuals where the risk is high	Without undue delay
DORA, Articles 17 and 19	Financial entities	ICT-related incident management process; reporting of major incidents	Set by the related technical standards

NIS2: handle and report

Article 21(2) of NIS2 lists the minimum measures provided for regulated entities. They include incident handling (point b) and business continuity, including crisis management (point c). The directive does not say how to organise this: in-house team, managed SOC or external responder. It sets out measures without imposing a particular organisational model.

Article 23 then sets a tight reporting timetable for significant incidents: an early warning within 24 hours of becoming aware, an incident notification within 72 hours and a final report within one month. Those deadlines presuppose a detection and analysis capability. See Does a managed SOC help with NIS2?.

Where does France stand? As of 18 October 2026, France had not transposed NIS2. Its “resilience” bill was passed by the Senate on 12 March 2025 and reworked by a special committee of the National Assembly (text of 10 September 2025), before being withdrawn from the agenda on 6 October 2026. The European Commission referred France to the Court of Justice of the EU on 8 July 2026. To check whether you are in scope, see Who does NIS2 apply to?.

GDPR: the rule that applies to almost everyone

The GDPR applies to every organisation processing personal data, whatever its size. Three articles matter when an incident hits:

• Article 32: it provides that security includes the ability to restore the availability of and access to personal data in a timely manner after an incident.
• Article 33: it provides that a breach posing a risk to individuals be notified to the supervisory authority within 72 hours of becoming aware of it. Under the same article, information can be provided in phases if it is not all available at once, and every breach, notified or not, is to be documented internally.
• Article 34: it provides for informing the individuals concerned where the risk is high.

For what counts as a breach, see What is a cybersecurity incident?.

Other frameworks to know

• DORA (Regulation (EU) 2022/2554), applicable since 17 January 2025, provides for financial entities to run an ICT-related incident management process (Article 17) and to report major incidents (Article 19).
• Critical infrastructure operators are often covered by sector-specific or national texts of their own, separate from NIS2, which may include incident reporting. The detail is in those texts.
• Insurance in France: Article L12-10-1 of the French Insurance Code, introduced by the LOPMI law of 24 January 2023, addresses the link between payouts for cyberattack losses and filing a police complaint, with a 72-hour window. The conditions of a given policy are best checked with the insurer and a legal adviser.

What about unregulated businesses?

Even outside NIS2 and DORA, comparable requirements can come from elsewhere:

• customer contracts: a regulated customer may expect its suppliers to alert it quickly and handle incidents properly. See Does NIS2 affect me if my client is in scope?;
• cyber insurance: policies can set notification deadlines and sometimes name specific responders;
• business continuity: without a response capability, a routine incident can drag on for weeks.

What is useful to have in place

1. A way to detect incidents, day and night.
2. A procedure stating who triages, who decides and who reports.
3. A named responder for the technical work. See What does incident response cover?.
4. The right contacts: authorities, insurer, lawyer. See Who should you contact after a cyberattack?.

At Cyna, the 24/7 managed SOC is backed by a CERT team that can be mobilised quickly. The incident response on-call team is available 24/7 from the Report an incident page.

Talk to an expert

Want to review your detection and response capability, or your clients’? If you already work with a Cyna partner MSP, they are your first point of contact. For an analysis of your legal obligations, your legal adviser remains the right contact. Otherwise, get in touch.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

Does a small business outside NIS2 have any obligations?

The GDPR applies as soon as an organisation processes personal data, which is almost always. It provides, among other things, for securing data, documenting breaches and notifying those that pose a risk. What applies to a given business is best checked with its legal adviser. See Does NIS2 apply to SMEs?.

Who reports the incident: the business, the MSP or the SOC?

The texts say who reports: Article 23 of NIS2 refers to the entities in scope, Article 33 of the GDPR to the data controller. The MSP and SOC can help by providing the facts. Who reports in a given situation is best checked with a legal adviser.

What happens if a business fails to notify?

The texts provide for administrative penalties. Article 83 of the GDPR sets, for breaches of Article 33, a maximum fine of 10 million euros or 2% of worldwide annual turnover. NIS2 also provides for fines, set out in each national law. Any penalty in a given case is for the competent authority to decide.

Does my cyber insurance impose anything?

Policies often include conditions such as prompt claim notification, insurer-approved responders or a police report. In France, Article L12-10-1 of the Insurance Code addresses the link between cyberattack cover and a police complaint, with a 72-hour window. Read your policy before an incident and check its conditions with your insurer.