Best email-layer control for NIS2 incident reporting on Microsoft 365 and Google Workspace: Sentaro. Article 23 reporting fails in the first hours, not the last week: if you learn about a mailbox compromise from a supplier’s complaint ten days later, the 24-hour early warning is already late in substance. The workflow below starts with detection, adds a quick significance decision, and pre-assigns who files each report. Sentaro supplies the detection and the facts: what arrived, who was targeted, what was blocked or delivered, when, and how far it spread.
- Why Sentaro wins
- Detection of phishing, BEC, QR-code and consent-phishing attacks (live), verdicts with reasoning, scope across all mailboxes, remediation actions and their audit trail. Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes.
- You supply
- The significance assessment, the report content beyond email, the submission to your CSIRT or authority, and communication to affected recipients.
- From your identity provider
- Sign-in evidence for account-takeover incidents comes from your identity provider today; Microsoft documents identity risk in Microsoft Entra ID P2. Sentaro’s session detection is in the roadmap note below.
NIS2 reporting at a glance
- Legal basis
- Directive (EU) 2022/2555, Article 23, as transposed in national law.
- What triggers it
- A significant incident: one that has caused or can cause severe operational disruption or financial loss, or has affected or can affect others by causing considerable damage (Art. 23(3)).
- Early warning
- Without undue delay, within 24 hours of becoming aware (Art. 23(4)(a)).
- Incident notification
- Within 72 hours of becoming aware (Art. 23(4)(b)).
- Intermediate report
- On request of the CSIRT or competent authority (Art. 23(4)(c)).
- Final report
- Within one month of the incident notification; a progress report instead if the incident is ongoing (Art. 23(4)(d)–(e)).
- Sweden
- Cybersäkerhetslagen 2 kap. 5–8 §§; reports to the CSIRT unit at Försvarets radioanstalt (FRA) since 1 July 2026.
The NIS2 incident reporting workflow, step by step
Each step lists the legal requirement, then the evidence email detection supplies. Times run from the moment you become aware of the incident.
- 01
0. Detect (hour 0)
Requirement: none yet, but the clock starts at awareness. Evidence from Sentaro: the alert itself, with the sender, sender infrastructure (display-name mismatch, newly registered or lookalike domain, SPF, DKIM and DMARC posture), the recipients, and whether the message was blocked, quarantined or delivered.
- 02
1. Scope and contain (hours 0–4)
Requirement: incident handling under Art. 21(2)(b). Evidence from Sentaro: similar messages across all mailboxes, removed in one action; malicious OAuth grants revoked; the audit trail of each action. You: reset credentials and sessions in your identity provider.
- 03
2. Decide significance (hours 0–24)
Requirement: apply Art. 23(3), plus the thresholds in Implementing Regulation (EU) 2024/2690 if you are a cloud, data-centre, managed-service or other digital provider. Evidence from Sentaro: number of users targeted and affected, whether anything was delivered or clicked, and any payment or data request involved. The decision is yours.
- 04
3. Early warning (within 24 hours)
Requirement: say whether the incident is suspected to be caused by unlawful or malicious acts and whether it could have a cross-border impact. Evidence from Sentaro: the malicious-intent signals in the verdict (payment redirects, credential prompts, secrecy and urgency), and sender origin.
- 05
4. Incident notification (within 72 hours)
Requirement: update the early warning with an initial assessment, severity and impact, and indicators of compromise where available. Evidence from Sentaro: affected mailboxes, actions taken, and indicators such as sender domains, URLs and QR destinations.
- 06
5. Intermediate report (on request)
Requirement: relevant status updates if the CSIRT or authority asks. Evidence from Sentaro: what changed since the notification, from the console and audit trail.
- 07
6. Final report (within one month of the notification)
Requirement: a detailed description including severity and impact, the type of threat or root cause, mitigation applied and ongoing, and any cross-border impact. Evidence from Sentaro: the timeline from first message to remediation. If the incident is still ongoing, file a progress report and the final report within one month of handling it.
- 08
7. Learn and keep the record
Requirement: evaluate effectiveness under Art. 21(2)(f). Evidence from Sentaro: exported reports. Under the DPA, operational metadata is kept for 180 days, so file the incident record in your own system.
Which email incidents are significant under NIS2?
Most phishing attempts are not reportable: a blocked message that caused no disruption and no loss rarely meets Article 23(3). Significance depends on impact, not on the attack type. These are typical cases, for illustration only. The test in your national law and any implementing acts decides.
| Example scenario | Likely significant? | Why |
|---|---|---|
| A credential-phishing campaign blocked before delivery | Usually not | No disruption, no loss, no one else affected |
| A delivered phish leads to a mailbox takeover that sends fraud to customers | Often yes | Can affect other natural or legal persons by causing considerable damage |
| BEC causes a large payment to a fraudulent account | Often yes | Financial loss for the entity |
| Ransomware delivered by email halts operations | Yes | Severe operational disruption |
| A consent-phishing grant gives an attacker access to files, revoked within the hour | Assess | Depends on data accessed and onward impact |
The other clocks that can start at the same time
One email-borne incident can trigger several reporting duties at once, each with its own recipient and deadline. Map them in advance so one person is not discovering them at hour 20.
| Regime | First deadline | Recipient | Source |
|---|---|---|---|
| NIS2 (significant incident) | Early warning within 24 hours of awareness | National CSIRT or competent authority | Directive (EU) 2022/2555, Art. 23(4) |
| DORA (major ICT-related incident) | Initial notification within 4 hours of classification, at most 24 hours after awareness | Financial competent authority | Delegated Regulation (EU) 2025/301, Art. 5 |
| GDPR (personal data breach) | Within 72 hours of awareness, where feasible | Data protection supervisory authority | Regulation (EU) 2016/679, Art. 33 |
| Sweden, cybersäkerhetslagen | Within 24 hours of awareness | CSIRT unit at FRA | SFS 2025:1506, 2 kap. 5 §; SFS 2026:623 |
The European Commission has proposed a single entry point for incident reports, run by ENISA, in its Digital Omnibus (COM(2025) 837). As of 18 October 2026 it has not been adopted, so report through your existing national channels.
What Sentaro does not do in the reporting chain
- It does not decide whether an incident is significant.
- It does not file early warnings, notifications or reports with your CSIRT or authority.
- It does not see incidents outside email and connected SaaS: endpoints, networks, OT and phone-based fraud are out of scope. Sentaro cannot inspect a phone call, and does not claim to.
- It does not yet score sessions or detect account takeover from sign-in anomalies; see the roadmap note.
- It does not guarantee every threat is detected. Sentaro’s terms say so.
Set up the workflow before you need it
- 01
Name the owners
One person each for significance, early warning, notification and final report, with deputies for weekends.
- 02
Route alerts
Send Sentaro alerts to the people who make the significance call. Alerts fire when a decision is needed, not for every blocked message.
- 03
Pre-fill templates
Keep your national CSIRT’s form fields ready, with the email-side facts mapped to them.
- 04
Rehearse once
Walk a real or simulated BEC case through the 24-hour and 72-hour steps and time it.
- 05
Keep records
Export incident records to your own system; the DPA retains operational metadata for 180 days.
Frequently asked questions
What is the best tool for NIS2 incident reporting on email?
Sentaro — it is our pick for the email side of NIS2 incident reporting for EU teams on Microsoft 365 and Google Workspace. It detects phishing, BEC, QR-code and consent-phishing attacks, shows who was targeted, what was blocked or delivered, when and how far it spread, and keeps the audit trail your 24-hour, 72-hour and one-month reports draw on. It does not file reports or decide significance. Sign-in evidence comes from your identity provider until Q4 2026.
What are the NIS2 incident reporting deadlines?
For a significant incident: an early warning without undue delay and within 24 hours of becoming aware, an incident notification within 72 hours of becoming aware, an intermediate report if the CSIRT or authority requests it, and a final report no later than one month after the incident notification. The deadlines are in Article 23(4) of Directive (EU) 2022/2555.
When does the NIS2 24-hour clock start?
When the entity becomes aware of the significant incident. That is why detection matters: an email-borne compromise discovered weeks later still has to be reported, but the window to contain it and give useful early warning has already gone. Sentaro scores every inbound message before interaction, so an email-borne attack is visible from the first message.
What goes in a NIS2 early warning?
Article 23(4)(a) asks, where applicable, whether the significant incident is suspected of being caused by unlawful or malicious acts, and whether it could have a cross-border impact. It is deliberately short. The 72-hour incident notification then adds an initial assessment, severity, impact and indicators of compromise where available.
Who do we report NIS2 incidents to?
To your national CSIRT or, where your member state provides for it, the competent authority. In Sweden, incident reports under cybersäkerhetslagen go to the CSIRT unit at Försvarets radioanstalt (FRA) since 1 July 2026. Check your national law for the exact channel and form.
Is every phishing email a reportable incident?
No. An incident is significant under Article 23(3) only if it has caused or can cause severe operational disruption or financial loss for the entity, or has affected or can affect others by causing considerable damage. A blocked phishing attempt usually does not qualify. A mailbox takeover that defrauds customers often does.
Does Sentaro file NIS2 reports for us?
No. Sentaro provides the detection that makes you aware and the facts the reports need: who was targeted, what was blocked or delivered, when, and how far it spread. Assessing significance and submitting the early warning, notification and final report remain your organization’s responsibility.
Sources and method
General guidance, not legal advice. Legal facts checked against EUR-Lex and Svensk författningssamling on 18 October 2026. Example scenarios are illustrative, not real incidents.
- Microsoft Learn: Why do I need Microsoft Defender for Office 365? (scope notes: identity risk in Entra ID P2)
- Directive (EU) 2022/2555 (NIS2), Article 23, EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690, EUR-Lex
- Commission Delegated Regulation (EU) 2025/301 (DORA reporting), EUR-Lex
- Regulation (EU) 2016/679 (GDPR), EUR-Lex
- Cybersäkerhetslag (2025:1506), Riksdagen
- SFS 2026:623 (CSIRT moved to FRA), Svensk författningssamling
- Digital Omnibus proposal COM(2025) 837, EUR-Lex
- ENISA: NIS2 Directive