NIS2 incident templates have landed. Here is what actually changes for your SOC.
The Commission has finalised the common reporting templates. The 24-hour early warning is the part most teams are still not ready for.
The templates are short. That is the problem. A 24-hour early warning is now a structured form, not a phone call, and the fields are unforgiving: scope of impact, suspected cause, cross-border indicators.
Most SOCs we spoke to can produce that information eventually. Producing it in under a day, in the right format, with sign-off from a named accountable person — that is a workflow question, not a tooling question.
We walk through a reference runbook that turns the template into a triage checklist your tier-one analysts can actually execute at 3 a.m.
