IR006Notification to a supervisory authority

The reporting of the incident, or of its handling, to an authority outside the organization.

Pillar: IR | Incident response
Sources cited: 10
In ITER: T1 | Disclosure of personal data | T2 | Disclosure of proprietary information | T3 | Alteration or destruction of records | T4 | Interruption of an operational service | T5 | Unauthorized consultation, without extraction
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
IR006/EUMandatory	European Union	Commission Implementing Regulation (EU) 2024/2690European Commission · read 29 Aug 2026	What the directive’s categories hold, in an annex setting out asset classification, the inventory, access control, privileged accounts, and removable media as requirements rather than as headings.	For the digital infrastructure and service providers it reaches, communication plans and procedures are established with the incident response teams or, where applicable, the competent authorities, for the notification of an incident.
IR006/HRMandatory	Croatia	Zakon o kibernetičkoj sigurnosti, članci 4, 29, 30, 37, and 38Hrvatski sabor · read 5 Oct 2026Uredba o kibernetičkoj sigurnostiVlada Republike Hrvatske · read 5 Oct 2026	For key and important entities, that the members of the management bodies answer for the risk management measures, approve them, control their implementation, and follow and offer employees suitable training; that the measures include human resources security, access control policies and management of software and hardware assets with a regularly updated inventory, incident handling with monitoring, recording, and reporting, cyber hygiene and training, and multi-factor or continuous authentication; that a significant incident is notified to the competent CSIRT and, where there are grounds to suspect a criminal offence, to the law enforcement bodies; and that the measures and their implementation are set by the Government’s regulation.	For key and important entities, an incident with a significant effect on the availability, integrity, confidentiality, or authenticity of data of significance for the business or on the continuity of services is notified to the competent CSIRT, and recipients of services are informed of significant incidents and serious threats. For key and important entities, the early warning of a significant incident reaches the competent CSIRT without delay and within 24 hours of learning of it, and the initial notification within 72 hours; trust service providers give the initial notification within 24 hours.
IR006/GRMandatory	Greece	Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026	For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, a significant incident, one causing or able to cause serious operational disruption or financial loss, or significant damage to others, is reported to the CSIRT of the Εθνική Αρχή Κυβερνοασφάλειας in an early warning within 24 hours, a notification within 72 hours, and a final report within one month; trust service providers notify within 24 hours.
IR006/ITMandatory	Italy	Determinazione ACN n. 379907 del 18 dicembre 2025Agenzia per la cybersicurezza nazionale · read 29 Aug 2026	The baseline security measures an Italian NIS subject has to adopt, among them the recording of remote and administrative access and its central retention, the detection of privilege abuse, and the vetting of the people admitted to the systems that matter.	For a subject in the national NIS register, the plan carries the procedures for preparing and sending the reports the NIS decree requires, and it names the contacts through which an incident is reported. Notification runs to CSIRT Italia.
IR006/ROMandatory	Romania	Ordonanța de urgență nr. 155/2024, articolele 11 la 15Guvernul României · read 5 Oct 2026	For essential and important entities, that the measures include the logging and traceability of all activities in the networks and information systems, human resources security, access control policies and asset management, and incident handling; that the management bodies approve the measures, supervise them, and answer for breaches, follow accredited training and ensure training of all personnel; that an annual self-assessment of maturity goes to the DNSC; and that a significant incident is notified in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, a significant incident, one causing or able to cause serious operational disruption or financial loss, or considerable damage to others, is reported to the national CSIRT in an early warning within 24 hours, a notification within 72 hours, and a final report within one month of the notification.
IR006/SEMandatory	Sweden	Cybersäkerhetslag (2025:1506)Riksdag · read 5 Oct 2026	That operators in scope take appropriate and proportionate technical, operational, and organizational measures that include access control and asset management, personnel security, cryptography, and cyber hygiene and training, that the persons in an operator’s management undergo training on security measures, that a significant incident is notified within 24 hours of knowledge and reported within 72 hours with a final report within one month, and that the government designates the supervisory authority or authorities.	For operators in scope, a significant incident is notified to the supervisory authority within 24 hours of knowledge, reported within 72 hours, and closed by a final report within one month of the notification.
IR006/CHMandatory	Switzerland	Bundesgesetz über den Datenschutz (DSG), SR 235.1, Artikel 6, 19, 21, 22, 24, 31, and 61Federal Assembly · read 5 Oct 2026	That processing is lawful, in good faith, and proportionate, for a purpose recognizable to the person and compatible with it, that the controller informs the person of the collection, that a decision resting on automated processing alone with legal or significant effect is disclosed to the person, that a prior impact assessment is made where processing may carry a high risk for the personality or fundamental rights, that a security breach likely to carry a high risk is notified to the EDÖB as fast as possible, that an infringement of personality is unlawful unless justified by consent, an overriding private or public interest, or law, and that natural persons are fined up to CHF 250,000 for the listed intentional breaches.	A security breach likely to carry a high risk for the personality or fundamental rights of the person is notified to the EDÖB as fast as possible.
Recommended	Irelandwhere written	Guidance on Cyber Governance for Management Board Members in NIS2 entitiesNational Cyber Security Centre · read 5 Oct 2026	That the management body of an essential or important entity approves the risk management measures, supervises their implementation, follows training and offers it to employees, and is accountable for non-compliance; that insider threats are among the threats a board identifies; and that an incident response plan, a classification procedure, a designated team, and external notification procedures are what response readiness holds.	The classification procedure states the criteria on which an incident is one that requires regulatory reporting.
Reported	Czechiawhere written	Redefining Threats: Extending the Threat Response Focus from External to Internal ThreatsHološka and Doucek · read 30 Aug 2026	How the examination of an employee is divided between security, human resources, and legal, what a classification level governs once it has been applied, and which restrictions are placed on a person serving out notice when they cannot be placed on everyone.	It falls to the legal function to state where an incident has to be reported to a public authority, and where personal data have been lost the supervisory authority is to be told without undue delay.