The Four Clocks of an EU Cyber Incident

Field notes

The site organizes four EU reporting regimes around the questions that matter during an incident: who is covered, what triggers the duty, when the clock starts and where the notification goes. Its opening table lists first-filing windows of four hours for DORA, 24 hours for NIS2 and the Cyber Resilience Act, and 72 hours for the GDPR. The homepage also separates DORA classification from incident awareness and distinguishes controllers from processors under the GDPR.