NIS2 Incident Reporting in 24 and 72 Hours: What It Takes and What a GDPR-Compliant 24×7 SOC Costs (2026)

Service guide · Updated 6 October 2026 · NIS2 cost calculator · NIS2 gap analysis

In short: NIS2 gives you 24 hours for an early warning and 72 hours for an incident notification once you know about a significant incident; GDPR adds 72 hours for personal data and DORA 4 hours for financial entities. Meeting those windows means someone has to detect, assess and document the incident at any hour. The ITSECOPS shared 24×7 SOC does that for EUR 550 to 1,650 per month at about 50 employees, contracted through Stavanger, Norway under a GDPR data processing agreement, which is about a tenth of an in-house team.

The Sophos Active Adversary Report 2026 found that 88 percent of ransomware encryption and 79 percent of data exfiltration happened outside business hours, with attackers reaching Active Directory in a median of 3.4 hours. Under NIS2 the reporting clock starts when you become aware of the incident, and supervisors in Italy (ACN, inspections from November 2026), the Netherlands (Cyberbeveiligingswet since 15 August 2026), Germany (BSI) and Sweden (cybersäkerhetslagen since January 2026) can ask for the evidence that you became aware promptly. An alert that nobody reads until Monday is both a security failure and a reporting failure.

The reporting clock, by law

What a 24-hour early warning actually requires

1. Detection at any hour: EDR, identity, email and cloud alerts land in a queue that a person opens within 15 minutes, nights and weekends included.
2. Assessment: an analyst confirms whether the alert is a significant incident under the NIS2 definition (severe operational disruption or financial loss, or considerable damage to others) and records the time of awareness.
3. Containment: the device is isolated, the account disabled or the sender blocked under rules you approved in advance, so the 72-hour notification can describe what was stopped, not what is still running.
4. Evidence: logs retained centrally for 12 months, with the timeline exported for the CSIRT, the data protection authority or the insurer.
5. The text: a runbook with the early-warning template, the 72-hour notification template and the final report structure, with a named signatory and a named submitter on your side.

Cost comparison: shared SOC, local MSSP, in-house team

ITSECOPS ranges are the published managed SOC prices for Europe; local MSSP ranges are typical quotes seen in client comparisons in 2026 and vary by country. The NIS2 cost calculator puts the SOC line next to SIEM, EDR, backup, training and the one-off work so you see the whole budget.

GDPR-compliant by contract, not by promise

• Contracting party in the EEA: the ITSECOPS office in Stavanger, Norway, signs the agreement and the GDPR data processing agreement.
• Operations centre in India under standard contractual clauses: analysts work on alerts and tickets; your logs stay in your tenant (Microsoft Sentinel) or in an EEA-hosted SIEM (Wazuh or Elastic).
• Documented sub-processors, breach notification to you within hours, audit rights and an NDA on request, so your own Article 28 obligations are covered.
• Evidence for supervisors: monthly reports of alerts handled, incidents contained and response times, in the format ACN, BSI, the NCSC and cyber insurers ask for.

Frequently asked questions

What exactly must be reported under NIS2 and when?

Article 23: an early warning to the national CSIRT within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours with an initial assessment of severity and impact, and a final report within one month. Where personal data is involved, GDPR Article 33 adds a 72-hour notification to the data protection authority, and DORA requires financial entities to make an initial notification within 4 hours of classification.

Can a shared SOC meet a 24-hour reporting deadline?

That is what it is for. The clock starts when you become aware; a SOC that triages critical alerts in 15 minutes and keeps the evidence makes awareness, assessment and the early-warning text a matter of hours, not days. The runbook names who signs and who submits.

What does 24×7 SOC coverage cost compared with an in-house team?

Published ITSECOPS ranges: EUR 550 to 1,650 per month at about 50 employees, EUR 1,400 to 3,700 at 100 to 200, EUR 2,750 to 7,350 at about 500 and EUR 7 to 15 per endpoint above that. An in-house 24×7 SOC needs at least five analysts and a lead: $45,000 to $70,000 a month in salaries alone before SIEM licences, which is why the shared model costs about a tenth.

Is the service GDPR-compliant if analysts sit in India?

The contracting party is the ITSECOPS office in Stavanger, Norway, inside the EEA, with a GDPR data processing agreement and standard contractual clauses covering the operations centre in Greater Noida. Logs stay in your own tenant or an EEA-hosted SIEM; analysts work on alerts, not on copies of your data.

We already have EDR. Do we still need a SOC?

EDR detects; a SOC decides and acts. In 88 percent of ransomware cases in the Sophos Active Adversary Report 2026 the encryption started outside business hours, and EDR alone cannot write a 24-hour early warning. Most clients keep their EDR and add the SOC on top of it.

Related

NIS2 cost calculator · NIS2 gap analysis tool · Managed SOC pricing in Europe · SIEM as a service · NIS2 country guides · Client testimonials