NIS2 Art.23.9: Voluntary Incident and Threat Notification

Create an internal process for identifying incidents, threats, and near misses worth reporting voluntarily. Set criteria that are deliberately broader than the mandatory thresholds: incidents that provide useful threat intelligence, attacks detected and prevented before impact, new techniques or vulnerabilities you have observed, and emerging threats relevant to your sector.

Work voluntary reporting into your incident response workflow. After determining an incident does not meet the mandatory threshold, explicitly ask: would reporting this help the broader community or get us useful CSIRT feedback?

Develop a lightweight voluntary notification template. Keep it simple: event type (incident, threat, or near miss), a brief description, relevant indicators of compromise, and any lessons learned.

Foster a culture where near miss reporting is valued, not punished. Make it clear that flagging a close call is a sign of good detection, not a failure. Recognise teams that contribute to the organisation's threat intelligence through proactive reporting.

Track voluntary reports alongside mandatory ones and look for patterns. A string of near misses in one area often signals a systemic issue that, left unaddressed, will eventually produce a significant incident. Feed this data back into your risk assessments.

Join sector-specific and cross-sector information-sharing communities. ENISA and national CSIRTs often facilitate these, and they are an excellent source of early threat intelligence.

Measure the return on your voluntary reporting: CSIRT feedback received, threats spotted early, improvements made from near miss analysis, and your contributions to sector-wide intelligence.