24-hour incident reporting: what the CSRB demands
The Cyber Security and Resilience Bill introduces the UK's most aggressive cyber incident reporting timeline. Regulated organisations must issue an initial notification within 24 hours and a full report within 72 hours -- or face penalties up to 4% of global turnover.
What does the 24-hour rule actually require?
Section 15 of the Cyber Security and Resilience Bill (Regulation 11A) requires every regulated entity to submit an initial incident notification within 24 hours of becoming aware of a reportable incident. The clock starts at operational awareness -- not at root-cause confirmation.
This initial report is deliberately short-form: confirm the incident occurred, describe its nature, and state what immediate measures you have taken. The detailed assessment follows in the 72-hour full report. Notifications must go to both the relevant designated regulator and the CSIRT simultaneously.
From detection to annual review
The CSRB imposes a multi-stage reporting lifecycle. Miss any window and penalty exposure begins immediately.
Detection
T = 0Incident identified. The clock starts the moment an authorised person becomes aware.
Initial notification
Within 24 hoursShort-form alert to regulator + CSIRT: incident type, scope, and immediate actions.
Full report
Within 72 hoursDetailed assessment: nature, impact, affected systems, root cause (if known), and remediation.
Customer notification
As soon as practicableInform affected UK customers of the incident nature and likely adverse effects on them.
Ongoing obligations
ContinuousUpdates as new information emerges. Annual reporting to regulators on incident patterns.
Incident vs. near miss vs. non-reportable
The CSRB widens the reporting net far beyond actual service disruption. Understanding the threshold is critical to compliance.
| Category | Definition | Reportable? | Example |
|---|---|---|---|
| Significant incident | An event that has, is having, or is likely to have a significant impact on service continuity, security, or integrity. | Yes -- 24h + 72h | Ransomware encrypts production systems and halts operations for 8 hours. |
| Near miss | An event capable of having a significant impact, even if impact was averted. | Yes -- same timeline | Attacker gains initial access via compromised credentials; detected and contained before lateral movement. |
| Non-reportable event | Routine security events with no potential for significant impact. | No | Automated port scan blocked at perimeter firewall with no further indicators. |
Threshold ambiguity
The Bill does not include a prescriptive list of factors for judging "significant impact." Parliamentary debate on Regulation 11A(3) has noted the breadth of the definition, and sector-specific thresholds may be set in secondary legislation. Until those arrive, regulated organisations should err on the side of reporting.
CSRB vs. GDPR vs. NIS2 reporting timelines
Organisations operating across UK and EU jurisdictions face overlapping but distinct incident reporting obligations.
| Aspect | CSRB (UK) | GDPR (UK/EU) | NIS2 (EU) |
|---|---|---|---|
| Initial notification | 24 hours | 72 hours (single notice) | 24 hours (early warning) |
| Full report | 72 hours | N/A -- single notification | 72 hours (incident notification) |
| Final / lessons-learned report | Updates as information emerges | N/A | 1 month after notification |
| Trigger | Significant impact or capability of significant impact (near miss) | Risk to rights and freedoms of individuals | Significant impact on service provision |
| Who receives it | Designated regulator + CSIRT simultaneously | Supervisory authority (ICO in UK) | CSIRT or competent authority |
| Customer notification | As soon as reasonably practicable | Without undue delay (if high risk) | Without undue delay (if significant) |
| Model | Two-stage (24h + 72h) | Single notification | Three-stage (24h + 72h + 1 month) |
An incident that constitutes both a NIS incident and a GDPR personal data breach requires separate notifications under different legal bases. Dual-reporting procedures should be built into your incident response plan. See our NIS2 vs CSRB comparison for a deeper analysis.
Who must you notify -- and when?
Section 15 (Regulation 11A) requires simultaneous notification to two bodies, followed by customer disclosure.
Designated regulator
Your sector-specific competent authority (e.g. Ofcom for telecoms, the Information Commission for MSPs and digital service providers). Initial notification within 24 hours; full report within 72 hours.
CSIRT (NCSC)
A copy of every incident notification must be sent to the Computer Security Incident Response Team -- the NCSC -- at the same time as the regulator report. This dual-track is mandatory, not optional.
Affected customers
After notifying the regulator, you must inform UK customers likely to be adversely affected. The notification must explain the incident nature and its likely adverse effects. Regulators may also require public disclosure.
What reporting should MSPs provide after an incident?
Managed service providers face identical timelines to operators of essential services -- plus unique supply-chain disclosure requirements.
Core MSP reporting duties (Section 15, Regulation 11A)
- Submit initial notification to the Information Commission within 24 hours of becoming aware of the incident.
- Provide a full detailed report within 72 hours, including the nature of the incident, affected systems, impact assessment, and measures taken.
- Send a copy of both notifications to the CSIRT (NCSC) simultaneously.
- An incident is reportable if it affects your systems' operation or security and has, or is capable of having, significant impact in the UK.
- Notify affected customers as soon as reasonably practicable after reporting to the regulator, explaining why they are affected and what they should do.
Supply-chain cascade
Because MSPs hold privileged access to client networks, a single MSP breach can cascade across dozens of customer organisations. The CSRB recognises this systemic risk: an estimated 900-1,100 managed service providers fall within scope. If your MSP is compromised, your own reporting obligations may also be triggered even if your systems were not directly breached.
What must be included in your reports?
The initial 24-hour notification and the 72-hour full report serve different purposes and require different levels of detail.
| Element | 24-hour initial notification | 72-hour full report |
|---|---|---|
| Incident confirmation | Confirm that a reportable incident has occurred or is occurring. | Confirm and classify the incident type. |
| Nature and scope | Brief description of the incident nature and affected service(s). | Detailed analysis of attack vectors, entry points, and scope of compromise. |
| Impact assessment | Initial assessment of potential impact. | Quantified impact: systems affected, data compromised, service downtime, geographic reach. |
| Immediate measures | Actions taken to contain or mitigate. | Full containment, eradication, and recovery measures implemented. |
| Root cause | Not required at this stage. | Preliminary root-cause analysis (or an explanation of why it is still under investigation). |
| Cross-border impact | Flag if other UK or international services are affected. | Detail cross-border dependencies and any notifications to other jurisdictions. |
Penalties for late or non-reporting
Failing to report on time triggers the same penalty framework as a security failure. Under Section 21 (Regulation 18):
- Higher band: Up to the greater of £17 million or 4% of global turnover for failing to submit an incident notification under Regulation 11A(2).
- Standard band: Up to the greater of £10 million or 2% of global turnover for failing to copy notifications to CSIRT or failing to notify customers.
- Daily penalties: Up to £50,000 per day for continuing failure to comply with information or inspection requirements under Part 4.
The regulator may also require public disclosure of the incident if necessary to manage the threat or inform affected parties -- compounding reputational damage.
Near miss reporting: the hidden expansion of scope
The CSRB does not stop at actual breaches. Events capable of having a significant impact are now reportable -- even if no harm materialised. This fundamentally changes what your detection capabilities must cover.
Read the near miss reporting guideCan your team report an incident in 24 hours?
Most organisations cannot. Our readiness assessment identifies the gaps in your incident detection, classification, and reporting workflows -- before the regulator does.