OCDF — Regulatory Profile Selector

1 · Statutory incident-reporting deadlines

Rows appear only for regimes in your profile. Build these clocks into your incident response plan, at §4 of the IR plan template.

Regime	Trigger	Deadline	Recipient
NIS2 Art. 23 NIS2	Significant incident	Early warning ≤ 24 h · notification ≤ 72 h · final report ≤ 1 month	National CSIRT / competent authority
GDPR Art. 33 GDPR	Personal data breach with risk to individuals	≤ 72 h from awareness	Data protection authority
GDPR Art. 34 GDPR	High risk to individuals	Without undue delay	Affected data subjects
DORA Art. 19 DORA	Major ICT-related incident	Initial ≤ 4 h from classification / ≤ 24 h from awareness · intermediate ≤ 72 h · final ≤ 1 month	Competent financial authority
NIS2 Art. 23(1)–(2) NIS2	Significant incident likely to affect your customers; significant cyber threat	Without undue delay	Affected recipients of your services
CER Art. 15 CER	Significant disruption of an essential service at a designated critical entity	Initial ≤ 24 h · detailed report ≤ 1 month	Competent authority under national CER law
CRA Art. 14 CRA	Actively exploited vulnerability / severe incident in a product you manufacture	Early warning ≤ 24 h	ENISA / CSIRT via single reporting platform

Some reporting rows are hidden by your profile.

2 · Regulatory hooks per framework function

GOVERN

Management bodies must approve measures, oversee implementation and follow training; personal liability possible, per NIS2 Art. 20. NIS2
All-hazards, proportionate risk-management approach, per NIS2 Art. 21(1). NIS2
Management body bears final responsibility for ICT risk, per DORA Art. 5. DORA
Controller accountability and appropriate measures, per GDPR Art. 24 & 32. GDPR

IDENTIFY

Risk analysis and vulnerability handling policies, per NIS2 Art. 21(2)(a),(e); supplier and dependency knowledge, per Art. 21(2)(d). NIS2
Records of processing double as data-flow inventory, per GDPR Art. 30. GDPR
Identification of ICT-supported functions and information assets, per DORA Art. 8. DORA
Security requirements for products with digital elements feed procurement criteria. CRA

PROTECT

Cryptography policies, access control, MFA, hygiene & training, per NIS2 Art. 21(2)(f)–(j). NIS2
Encryption and pseudonymisation as named measures, per GDPR Art. 32. GDPR
Protection and prevention measures, per DORA Art. 9. DORA
Physical resilience measures for critical entities complement cyber controls. CER

DETECT

Reporting deadlines are only achievable with functioning detection, per NIS2 Art. 21(2)(b), 23. NIS2
Detection speed decides whether the 72 h deadline can be met, per GDPR Art. 33; security logs about employees are personal data, so limit them to their purpose, per Art. 5. GDPR
Prompt anomaly-detection mechanisms, per DORA Art. 10. DORA

RESPOND

Incident handling and staged reporting, per NIS2 Art. 21(2)(b), 23. NIS2
Notify DPA ≤ 72 h; document all breaches, even non-notified, per GDPR Art. 33(5), 34. GDPR
Incident management, classification and reporting, per DORA Art. 17–19. DORA

RECOVER

Business continuity, backups, disaster recovery and crisis management, per NIS2 Art. 21(2)(c); final report ≤ 1 month, per Art. 23. NIS2
Ability to restore availability and access to personal data in a timely manner, per GDPR Art. 32(1)(c). GDPR
Response & recovery plans, backup policies and testing, per DORA Art. 11–12. DORA
Continuity of essential societal functions under all-hazards scenarios. CER

Some regulatory hooks are hidden by your profile.

3 · National implementations across all 27 member states

Tick your member states in the panel. Each country's review date and confidence are in its national annex; always confirm against the national gazette.

Your country: tick it in the panel to see its implementation. Where a country's acts are mapped one by one, they appear under its checkbox. The other countries show their main NIS2 law only; contributions that add the sector acts are welcome.

Country notes are hidden by your profile.