The first 72 hours of an incident: what makes the difference

Hours 0–4: detect and contain

The goal is to stop the spread without destroying evidence: isolate affected systems, preserve logs and images, activate the response team and the decision chain. For financial entities, DORA requires an initial notification within 4 hours of classifying the incident as major.

Hours 4–24: assess and communicate

Scope and impact are estimated, internal communications and communications to customers and suppliers begin, and the NIS2 early warning is prepared within 24 hours. Service continues thanks to continuity measures prepared in advance.

Hours 24–72: eradicate and notify

Causes and persistence mechanisms are removed, verified systems are restored and notifications are completed: within 72 hours, the NIS2 notification and, if personal data are involved, the GDPR notification to the data protection authority. Forensic analysis continues to identify and fix the root cause.