24-hour incident reporting: what the CSRB demands.
The Cyber Security and Resilience Bill introduces the UK's most aggressive cyber incident reporting timeline. Regulated organisations must issue an initial notification within 24 hours and a full report within 72 hours -- or face penalties up to 4% of global turnover.
From becoming aware, not from root-cause confirmation.
- Full report
- Within 72 hours
- Send to
- Designated regulator + CSIRT
- Customers
- As soon as practicable
- Max penalty
- £17m or 4% of turnover
Source: Section 15 (Regulation 11A), Section 21 (Regulation 18)
What does the 24-hour rule actually require?
Section 15 of the Cyber Security and Resilience Bill (Regulation 11A) requires every regulated entity to submit an initial incident notification within 24 hours of becoming aware of a reportable incident. The clock starts at operational awareness -- not at root-cause confirmation.
This initial report is deliberately short-form: confirm the incident occurred, describe its nature, and state what immediate measures you have taken. The detailed assessment follows in the 72-hour full report. Notifications must go to both the relevant designated regulator and the CSIRT simultaneously.
From detection to annual review.
The CSRB imposes a multi-stage reporting lifecycle. Miss any window and penalty exposure begins immediately.
Detection
Incident identified. The clock starts the moment an authorised person becomes aware.
Initial notification
Short-form alert to regulator + CSIRT: incident type, scope, and immediate actions.
Full report
Detailed assessment: nature, impact, affected systems, root cause (if known), and remediation.
Customer notification
Inform affected UK customers of the incident nature and likely adverse effects on them.
Ongoing obligations
Updates as new information emerges. Annual reporting to regulators on incident patterns.
Incident vs. near miss vs. non-reportable.
The CSRB widens the reporting net far beyond actual service disruption. Understanding the threshold is critical to compliance.
| Category | Definition | Reportable? | Example |
|---|---|---|---|
| Significant incident | An event that has, is having, or is likely to have a significant impact on service continuity, security, or integrity. | Yes - 24h + 72h | Ransomware encrypts production systems and halts operations for 8 hours. |
| Near miss | An event capable of having a significant impact, even if impact was averted. | Yes - same timeline | Attacker gains initial access via compromised credentials; detected and contained before lateral movement. |
| Non-reportable event | Routine security events with no potential for significant impact. | No | Automated port scan blocked at perimeter firewall with no further indicators. |
The Bill does not include a prescriptive list of factors for judging "significant impact." Parliamentary debate on Regulation 11A(3) has noted the breadth of the definition, and sector-specific thresholds may be set in secondary legislation. Until those arrive, regulated organisations should err on the side of reporting.
CSRB vs. GDPR vs. NIS2 reporting timelines.
Organisations operating across UK and EU jurisdictions face overlapping but distinct incident reporting obligations.
| Aspect | CSRB (UK) | GDPR (UK/EU) | NIS2 (EU) |
|---|---|---|---|
| Initial notification | 24 hours | 72 hours (single notice) | 24 hours (early warning) |
| Full report | 72 hours | N/A -- single notification | 72 hours (incident notification) |
| Final / lessons-learned report | Updates as information emerges | N/A | 1 month after notification |
| Trigger | Significant impact or capability of significant impact (near miss) | Risk to rights and freedoms of individuals | Significant impact on service provision |
| Who receives it | Designated regulator + CSIRT simultaneously | Supervisory authority (ICO in UK) | CSIRT or competent authority |
| Customer notification | As soon as reasonably practicable | Without undue delay (if high risk) | Without undue delay (if significant) |
| Model | Two-stage (24h + 72h) | Single notification | Three-stage (24h + 72h + 1 month) |
An incident that constitutes both a NIS incident and a GDPR personal data breach requires separate notifications under different legal bases. Dual-reporting procedures should be built into your incident response plan. See our NIS2 vs CSRB comparison for a deeper analysis.
Who must you notify and when?
Section 15 (Regulation 11A) requires simultaneous notification to two bodies, followed by customer disclosure.
Designated regulator
Your sector-specific competent authority (e.g. Ofcom for telecoms, the Information Commission for MSPs and digital service providers). Initial notification within 24 hours; full report within 72 hours.
CSIRT (NCSC)
A copy of every incident notification must be sent to the Computer Security Incident Response Team -- the NCSC -- at the same time as the regulator report. This dual-track is mandatory, not optional.
Affected customers
After notifying the regulator, you must inform UK customers likely to be adversely affected. The notification must explain the incident nature and its likely adverse effects. Regulators may also require public disclosure.
What reporting should MSPs provide after an incident?
Managed service providers face identical timelines to operators of essential services -- plus unique supply-chain disclosure requirements.
Core MSP reporting duties (Section 15, Regulation 11A)
- Submit initial notification to the Information Commission within 24 hours of becoming aware of the incident.
- Provide a full detailed report within 72 hours, including the nature of the incident, affected systems, impact assessment, and measures taken.
- Send a copy of both notifications to the CSIRT (NCSC) simultaneously.
- An incident is reportable if it affects your systems' operation or security and has, or is capable of having, significant impact in the UK.
- Notify affected customers as soon as reasonably practicable after reporting to the regulator, explaining why they are affected and what they should do.
Because MSPs hold privileged access to client networks, a single MSP breach can cascade across dozens of customer organisations. The CSRB recognises this systemic risk: an estimated 900-1,100 managed service providers fall within scope. If your MSP is compromised, your own reporting obligations may also be triggered even if your systems were not directly breached.
What must be included in your reports?
The initial 24-hour notification and the 72-hour full report serve different purposes and require different levels of detail.
| Element | 24-hour initial notification | 72-hour full report |
|---|---|---|
| Incident confirmation | Confirm that a reportable incident has occurred or is occurring. | Confirm and classify the incident type. |
| Nature and scope | Brief description of the incident nature and affected service(s). | Detailed analysis of attack vectors, entry points, and scope of compromise. |
| Impact assessment | Initial assessment of potential impact. | Quantified impact: systems affected, data compromised, service downtime, geographic reach. |
| Immediate measures | Actions taken to contain or mitigate. | Full containment, eradication, and recovery measures implemented. |
| Root cause | Not required at this stage. | Preliminary root-cause analysis (or an explanation of why it is still under investigation). |
| Cross-border impact | Flag if other UK or international services are affected. | Detail cross-border dependencies and any notifications to other jurisdictions. |
Penalties for late or non-reporting.
Failing to report on time triggers the same penalty framework as a security failure. Under Section 21 (Regulation 18):
Up to the greater of £17 million or 4% of global turnover for failing to submit an incident notification under Regulation 11A(2).
Up to the greater of £10 million or 2% of global turnover for failing to copy notifications to CSIRT or failing to notify customers.
Up to £50,000 per day for continuing failure to comply with information or inspection requirements under Part 4.
The regulator may also require public disclosure of the incident if necessary to manage the threat or inform affected parties -- compounding reputational damage.
Near miss reporting: the hidden expansion of scope.
The CSRB does not stop at actual breaches. Events capable of having a significant impact are now reportable -- even if no harm materialised. This fundamentally changes what your detection capabilities must cover.
Incident reporting questions answered.
The CSRB requires all regulated entities -- operators of essential services, relevant digital service providers, and relevant managed service providers -- to submit an initial incident notification to their designated regulator and CSIRT within 24 hours of becoming aware of a significant incident. This initial report is a short-form alert confirming that an incident has occurred, its nature, and any immediate actions taken. A full detailed report must follow within 72 hours.
A reportable incident is one that has, is having, or is capable of having a significant impact on the continuity, security, or integrity of the network and information systems used to provide an essential service, digital service, or managed service in the UK. This covers actual disruptions and "near misses" -- incidents that could have caused significant impact even if they were mitigated before any harm materialised. Ransomware, supply chain compromises, and pre-positioning by threat actors all fall within scope.
Yes. The CSRB brings relevant managed service providers (RMSPs) into direct regulatory scope for the first time. MSPs that provide ongoing IT management, support, maintenance, or monitoring under contract -- and connect to customer systems -- must follow the same 24-hour initial notification and 72-hour full report timeline as operators of essential services and digital service providers. They must also notify affected customers as soon as reasonably practicable after reporting to the regulator.
Under GDPR Article 33, data controllers must notify the ICO of a personal data breach within 72 hours of becoming aware of it, in a single notification. The CSRB uses a two-stage model: a 24-hour initial notification followed by a 72-hour full report. The two regimes are independent -- an incident that constitutes both a NIS incident and a GDPR personal data breach requires separate notifications to different bodies under different legal bases.
An incident is an event that has actually disrupted or degraded the security, integrity, or availability of network and information systems. A near miss, under the CSRB, is an incident "capable of having" a significant impact -- meaning the threat was real and the potential consequences significant, but harm was averted through detection or mitigation. Both are reportable under the Bill, which is a major departure from the NIS Regulations 2018 which only required reporting of events with actual significant impact.
Can your team report an incident in 24 hours?
Most organisations cannot. Our readiness assessment identifies the gaps in your incident detection, classification, and reporting workflows -- before the regulator does.