24-hour incident notification: runbook and template
The initial notice under the Cyber Security and Resilience Bill (CSRB) only needs your name, the affected service and brief details of the incident. The hard part is deciding, approving and sending it inside 24 hours, so this guide gives you a timed runbook and templates to adapt.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Report Stage update: VinciWorks reports that Government amendments on 26 October 2026 narrowed the incident definition to incidents that have actually adversely affected systems, and removed mandatory near-miss reporting for data centre operators. We could not check this against the amended Bill, so the wording below reflects HL Bill 32 and may be out of date. See what Parliament changed.
What the law requires
The Cyber Security and Resilience Bill (CSRB) sets a two-step notice for regulated organisations, and both deadlines run from the same moment.
| Step | Deadline, from first awareness | Content |
|---|---|---|
| Initial notification | 24 hours | Your name, the affected service and brief details of the incident |
| Full notification | 72 hours | The six items listed in the 72-hour template below, so far as known |
Both must be in writing, in the form and manner your regulator determines. Send a copy to the CSIRT at the same time. The NIS Regulations name GCHQ as the CSIRT, and the National Cyber Security Centre is part of GCHQ.
A full notification sent at hour 72 is only 48 hours after an initial notification sent at hour 24. It is not a further 72 hours.
These rules are not yet in force, and we have not found a regulator form or official template. The templates below are unofficial working drafts.
A timed runbook
These timings are our suggestion, not legal requirements. "T" is the moment you are first aware that a reportable incident has occurred or is occurring.
| Time | Action | Owner |
|---|---|---|
| Detection | Log when the event was first detected and who raised it | On-call analyst |
| Within 1 hour of detection | Convene the incident lead and apply the significant incident test | Incident lead |
| Decision, T | Record the decision, reasons and time. If reportable, the clock is running | Incident lead |
| T+2h | Draft the initial notification. Don't wait for root cause | Compliance lead |
| T+4h | Legal and executive review. Agree a 1-hour limit on comments | Legal, senior approver |
| T+6h | Submit to the regulator and copy the CSIRT at the same time. Keep proof of both | Compliance lead |
| T+6h to T+48h | Gather facts for the full notification. Keep a timeline | Incident lead |
| T+48h | First full draft. Check for personal data and customer impact | Compliance lead, DPO |
| T+60h | Final review | Legal, senior approver |
| By T+72h | Submit the full notification and copy the CSIRT | Compliance lead |
| After T+72h | If you are a data centre, RDSP or RMSP, identify affected UK customers and notify them | Customer lead |
Set this up so it works at 2am on a bank holiday. Name deputies for every role, and keep templates and regulator contact details somewhere you can reach if your main systems are down.
24-hour initial notification template
INITIAL NOTIFICATION OF INCIDENT (unofficial draft)
To: [Regulator]
Copy: CSIRT
Date and time sent: [DD/MM/YYYY HH:MM UTC]
1. Organisation name: [Legal name]
Registration or reference number, if any: [Reference]
2. Service the incident relates to: [Essential, digital, managed or data centre service]
3. Brief details of the incident:
First aware at: [DD/MM/YYYY HH:MM UTC]
Summary: [One or two factual sentences]
Status: [Ongoing / contained / resolved / unknown]
Contact for follow-up: [Name, role, phone, email]
A full notification will follow within 72 hours of first awareness.
The Bill only requires your name, the service and brief details. The time of awareness, status and contact are additions we suggest, so remove them if a regulator's form says otherwise. Stick to facts, avoid speculating on who did it, and mark anything uncertain as unconfirmed.
72-hour full notification template
FULL NOTIFICATION OF INCIDENT (unofficial draft)
To: [Regulator]
Copy: CSIRT
Date and time sent: [DD/MM/YYYY HH:MM UTC]
Initial notification sent: [DD/MM/YYYY HH:MM UTC]
1. Name and service
Organisation: [Legal name]
Service the incident relates to: [Service]
2. Time and duration
Incident occurred: [Date and time, or best estimate]
Duration: [Length so far]
Ongoing: [Yes / No]
3. Nature of the incident
[What happened, as far as known]
4. Link to another regulated person
Caused by a separate incident at another regulated person? [Yes / No / Unknown]
If yes, details of that incident and organisation: [Details]
5. Impact, including cross-border impact
[Impact that has occurred, is occurring or is likely]
6. Other information that may help the regulator
[For example, mitigation under way or support requested]
Not yet known: [List anything still under investigation]
Contact for follow-up: [Name, role, phone, email]
The Bill asks for this information "so far as known", so a list of open questions is better than guessing. For data centres, item 5 also covers impact the incident could have had.
Customer notices
After the full notification, data centres, RDSPs and RMSPs must, as soon as reasonably practicable, take reasonable steps to find out which UK customers are likely to be adversely affected, then notify them. The notice must give details of the nature of the incident and explain why you consider that customer is likely to be affected. This duty does not apply to other operators of essential services under the Bill.
Check for a second report
A personal data breach can also need a separate report under UK GDPR, to the Information Commissioner without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk to people. That is a different test, so add this check to your runbook at the decision stage. Sector rules, contracts and insurance policies may also have their own notice terms.
Getting ready
- Name your regulator and record how to contact them.
- Fill in the fixed fields of each template now.
- Run a timed exercise, including one out of hours.
- Replace these drafts when your regulator publishes its requirements.
For the rules themselves, see incident reporting.
Sources
Frequently asked questions
The organisation’s name, the service the incident relates to, and brief details of the incident. It must be in writing, in the form and manner the regulator sets.
Your regulator, with a copy sent to the CSIRT at the same time. In the UK the National Cyber Security Centre carries out the CSIRT function. For RDSPs and RMSPs the regulator is the Information Commission.
No. Both periods start when you first become aware of the reportable incident. The full report is due 72 hours from that moment, so at most 48 hours after a notice sent at hour 24.
We have not found one. The Bill leaves the form and manner of notifications to each regulator, so treat the templates here as unofficial working drafts and replace them when regulators publish their requirements.