NIS2 Incident Reporting

Part of the NIS2 Evidence Pack. Audience: an operator’s compliance officer preparing NIS2 Article 23 incident notifications.

The NIS2 incident-reporting surface prepares Article 23 milestone records and handoff packets for customer/operator use. Stella Ops provides the reporting timeline, local envelopes, channel adapters, and signed handoff artifacts; the customer/operator remains the reporting party.

Article 23 puts the operator on a clock — an early warning within 24 hours, a full notification within 72 hours, and a final report within one month — and this surface tracks each milestone deterministically.

Claim boundary: operator-support.

Implementation Status (2026-06-16)

Verified against src/. This surface is partially shipped — it is the remaining real NIS2 gap:

Shipped & tested: the deadline state machine, the Article 23 milestone envelope builder (Nis2CsirtEnvelopeBuilder), the PGP email encryptor (Nis2OpenPgpEmailEncryptor), the ledger events, and a read-only timeline query GET /api/v1/regulatory/reporting-timelines?regime=nis2 (src/Notify/.../Endpoints/ReportingTimelineEndpoints.cs).
Not yet operator-usable: there are no operator write endpoints — Nis2IncidentTimelineLedgerHandoffService (open / classify / report / close) is DI-registered but invoked only by tests, so an operator cannot yet drive the timeline over HTTP.
No production CSIRT submission client: INis2CsirtSubmissionClient is defined, but the only implementation that ships is the test-project StubSubmissionClient. A real / generic signed-webhook submission client is still required before any channel-specific submission mode can be operated.

Until those land, this surface can prepare and read milestone records but cannot be used end-to-end by an operator to drive or submit an Article 23 report.

Source Docs

Channel Posture

The approved v1 adapter posture is DE, FR, and NL local adapters plus signed JSON webhook and PGP-encrypted email fallback for other Member-State workflows. Per-channel credentials, public recipient keys, and approvals are operator configuration.

Automatic submission must not be assumed. Default behavior should create a signed, replayable operator handoff artifact unless a tenant explicitly enables and audits a channel-specific submission mode.

Shared Timeline

NIS2, DORA, CRA, and future reporting packs must share one Notify reporting timeline model with pack-specific milestone profiles. Do not create a separate NIS2-only incident timeline store.

Runtime profile id: nis2.article23.incident.

Notify exposes the profile at GET /api/v1/assurance/reporting-timeline-profiles/nis2.article23.incident. Persisted timeline records remain on GET /api/v1/regulatory/reporting-timelines?regime=nis2.

Readiness for this pack is operator/customer focused:

Readiness input	Owner	Storage/config posture
CSIRT/NCA destination	Tenant/operator	UI or CLI setting persisted with tenant operator configuration.
PGP recipient public key	Tenant/operator	UI or CLI setting; public key only, never private key material.
Signed webhook key reference	Environment/operator	Secret reference in sealed Notify configuration.
Operator approval	Authority/operator	Fresh approval record or configured approval workflow.
Auto-submit enablement	Tenant/operator	Explicit opt-in; default remains disabled.
Handoff/output publication target	Environment or tenant/operator	Filesystem/object-store target or equivalent handoff route; no secret values in readiness payloads.

Stable readiness reason codes are documented in the Assurance Reporting Timeline v1 contract. A missing auto-submit setting does not prevent local signed handoff; it only makes autoSubmitReady false.

Change Log

Date (UTC) Update

2026-06-16 Reconciled to verified src/. Added an Implementation Status section marking this as the remaining real NIS2 gap: state machine / envelope builder / PGP encryptor / ledger events and a read-only timeline query are shipped, but there are no operator write endpoints (handoff service is test-only) and no production CSIRT submission client (only the test StubSubmissionClient). Claim boundary unchanged (operator-support).

Date (UTC)	Update
2026-06-16	Reconciled to verified `src/`. Added an Implementation Status section marking this as the remaining real NIS2 gap: state machine / envelope builder / PGP encryptor / ledger events and a read-only timeline query are shipped, but there are no operator write endpoints (handoff service is test-only) and no production CSIRT submission client (only the test `StubSubmissionClient`). Claim boundary unchanged (`operator-support`).