Runbook template

The 24-hour incident runbook

A one-page incident runbook with the NIS2 and GDPR reporting clocks side by side, roles, a decision tree for significant, and a drill.

Under NIS2, the 24-hour clock starts when a company becomes aware of a significant incident (art. 23(4)(a) Directive (EU) 2022/2555). I'm starting to see incident processes that are only a chat channel, with logs in the account an attacker would control. That setup can't meet the clock. This runbook fixes it on one page, and it serves NIS2 and the GDPR at the same time.

The names go in first. The page lives where the on-call person can find it at 03:00. The drill at the end runs once a quarter.

From the talk: NIS2 for startup engineers: what to build first

Roles

Every role has a backup. One person can hold two roles in a small team, but never the lead and the scribe.

Role	What they do	Name	Backup
Incident lead	Runs the response and decides the next step.
Decision owner	Decides whether the incident is significant and signs the reports.
Communications	Talks to customers, the authority, and the data protection contact.
Scribe	Keeps the timeline with timestamps, from the first alert on.

The clocks, side by side

Deadline	NIS2 (to the CSIRT or authority)	GDPR (personal data breach)
Within 24 hours of becoming aware	Early warning: whether the incident looks unlawful or malicious and whether it could have cross-border impact (art. 23(4)(a)).	No fixed step. The breach assessment starts.
Within 72 hours of becoming aware	Incident notification: an initial assessment, its severity and impact, and indicators of compromise where available (art. 23(4)(b)).	Notification to the supervisory authority, unless the breach is unlikely to result in a risk to people (art. 33(1) Regulation (EU) 2016/679).
On request	Intermediate status report (art. 23(4)(c)).
Without undue delay	A notice to affected service recipients where the incident is likely to hurt them (art. 23(1)).	A notice to the people affected when the risk to them is high (art. 34(1)).
Within one month of the notification	Final report: a detailed description, the likely root cause, the measures taken, and any cross-border impact (art. 23(4)(d)).
Our contracts	Any customer contract that promises faster notice.

Is it significant?

Art. 23(3) calls an incident significant when either answer is yes. The decision owner records the answer and the time.

Has it caused, or could it cause, severe disruption of the service or financial loss for us? Yes means significant.
Has it affected, or could it affect, other people or companies by causing considerable material or non-material damage? Yes means significant.
Neither? The reasoning goes in the log, and we keep watching. A new fact means a new decision.
Still unsure after four hours? I'd treat it as significant and send the early warning. A withdrawn warning costs less than a late one.

The first hour

We open the incident log. One channel, one document, and the scribe writing timestamps from the first alert.
We preserve evidence. Snapshots of affected disks, exported logs, and no deletions.
We contain it. Revoked keys or sessions, isolated systems, and a time against each action.
We start both clocks. The moment of awareness goes in the log. The NIS2 and GDPR deadlines run from there.
We check the contracts. Some customers expect notice sooner than the law does.

The drill: 45 minutes, a scenario, a stopwatch

At 02:10, GuardDuty reports that the CI pipeline's access key is listing S3 buckets from an unknown IP address. The on-call person gets the page, and the stopwatch starts. The drill asks four things: who wakes up, who decides on significance, which contracts need notice first, and whether the early warning exists in draft. If four hours pass before anyone knows who decides, that's the gap to fix this quarter. How long would your team take?

What I leave out on purpose

I leave out a 24/7 security operations centre, a SIEM with hundreds of rules, and a threat-hunting programme. A small team needs a few alerts that work, not many that nobody reads. The runbook and the drill matter more than the tooling at this stage.

Next step

I highly recommend running the drill with your team this month. If the stopwatch passes four hours before anyone knows who decides, a thirty-minute call will close that gap. Who decides on significance in your team today?

Book a call

These takeaways are an engineer's reading of the rules and the tools. I wrote them to help teams decide what to build. They aren't legal advice. I recommend checking the current text with your own counsel before planning around a date or a threshold.

How I help

Cloud security hardening

I find the gaps in your cloud accounts, identity, network, and data, rank them by what an attacker reaches first, and close them with your team.

Other takeaways from this talk

Scorecard

NIS2 supplier scorecard

Twenty yes/no questions mapped to NIS2 articles 20, 21, and 23: the ones a regulated customer's questionnaire will ask a startup supplier.

Answer bank

Questionnaire answer bank

Thirty supplier security questions with model answers and the evidence behind each one, so the next questionnaire starts from proof.

Let's talk.

A 30-minute call, no pitch. We look at your current setup, your stage, and the thing that's bothering you about it. I give a straight opinion on what to change, what to leave alone, and whether the problem is the one it looks like. What's the one thing in your stack you'd fix tomorrow?

Book a call See pricing

Prefer email or phone? hello@netninjas.eu or +31 6 45984313