NCA 72-Hour Notification: When Does the Clock Start?
The National Cybersecurity Authority's Essential Cybersecurity Controls framework imposes a clear obligation: regulated entities must notify the NCA within 72 hours of discovering a cybersecurity incident. The NCA 72 hour notification requirement under control 4-2-3 is unambiguous in its deadline, but silent on the question that determines whether your organization meets it—when exactly does discovery occur?
Most cybersecurity incidents are not discovered in a single moment. An alert fires in your SIEM. An analyst triages it. The security team scopes affected systems. Days later, forensic evidence confirms data exfiltration. At which point did you discover the incident? The answer determines whether your notification is timely or late, and whether your legal and compliance teams can meet the regulatory deadline without waiting for forensic certainty.
This article explains how to define discovery in your incident response playbook, which evidence to timestamp in your case-management system, and how to prepare the initial NCA X-Portal notification when you have partial information.
The Problem: Detection Happens in Stages
A typical detection timeline looks like this:
Day 1, 02:14 — SIEM alert: unusual volume of database queries from application server.
Day 1, 09:30 — SOC analyst reviews alert during morning shift, categorizes as medium priority, assigns to Tier 2.
Day 1, 14:00 — Tier 2 analyst examines logs, finds evidence of credential misuse, escalates to incident response team.
Day 2, 10:00 — IR team scopes affected systems, identifies lateral movement to file server containing customer records.
Day 3, 16:00 — Forensic analysis confirms exfiltration of 12,000 customer records over three-day period.
At which moment did the organization discover the incident? The initial alert? The escalation? The confirmation of data exfiltration? Each interpretation leads to a different notification deadline, and the difference can be 48 hours or more.
What 'Discovery' Means for Regulatory Notification
The NCA ECC does not define discovery with precision, so regulated entities must apply a reasonable interpretation that balances two competing obligations: notify promptly, and notify accurately.
Discovery occurs when a person with authority to act on behalf of the organization has sufficient information to reasonably believe that a cybersecurity incident affecting the confidentiality, integrity or availability of systems or data has occurred.
This definition has three components:
Authority to act — Not every employee who sees an alert has triggered the clock. Discovery requires that someone with responsibility for incident response—a SOC manager, CISO, incident response lead or designated deputy—has been informed.
Sufficient information — Not every anomaly is an incident. Discovery requires enough evidence to reasonably conclude that an incident has occurred, not merely that an alert has fired or an investigation is underway.
Reasonable belief — Discovery does not require forensic certainty. You do not need to wait for a final investigation report, root-cause analysis or confirmed impact assessment. You need enough information that a reasonable professional in your position would conclude an incident has occurred.
Defining the Discovery Moment in Your Playbook
Your incident response playbook should specify the discovery moment for each incident category. This removes ambiguity during an active response, when legal and compliance teams need a clear timestamp.
Ransomware
Discovery occurs when the incident response team confirms that ransomware has executed on production systems, whether or not the full scope of encryption is known. The initial ransom note or first confirmed encrypted host is sufficient.
Data Breach
Discovery occurs when the incident response team confirms unauthorized access to, or exfiltration of, data classified as confidential or personal under your data classification policy. You do not need to know the exact record count or confirm exfiltration if access is confirmed and exfiltration is reasonably likely.
Denial of Service
Discovery occurs when the incident response team confirms that a service disruption is caused by malicious activity, not a technical fault. The moment you conclude the outage is an attack, not an infrastructure failure, is the moment of discovery.
Insider Threat
Discovery occurs when the incident response team confirms that an employee or contractor has intentionally accessed, modified or exfiltrated data or systems beyond their authorization. Suspicion is not discovery; confirmed unauthorized activity is.
What to Timestamp in Your Case-Management System
Your incident case-management system—whether a dedicated platform or a structured ticketing system—must capture timestamps for each stage of detection and escalation. These timestamps are your evidence that you met the 72-hour deadline.
Record the following for every incident:
- Initial alert or report — When the first technical alert fired, or when the first report was received (e.g., from a user, third party or monitoring system).
- Triage completion — When an analyst completed initial triage and determined the alert warranted escalation.
- Incident response engagement — When the incident response team was formally engaged and assigned an incident case number.
- Discovery determination — When the incident response lead or CISO determined that sufficient information existed to conclude an incident had occurred. This is your notification clock start time.
- NCA notification submission — When the initial notification was submitted via the NCA X-Portal.
The discovery determination timestamp is the most important. It should be recorded by the incident response lead or CISO in the case-management system with a brief justification: "Confirmed unauthorized access to customer database based on forensic evidence of credential misuse and data extraction queries. Discovery determination made at 14:35 on 12 March 2025."
Preparing the Initial Notification with Partial Information
The NCA 72-hour deadline applies to the initial notification, not the final investigation report. You are not expected to have complete information within 72 hours. You are expected to notify the NCA that an incident has occurred and provide the information you have at that time.
The initial notification should include:
Incident classification — The type of incident (e.g., unauthorized access, ransomware, denial of service) based on your current understanding.
Discovery date and time — The timestamp when you determined that an incident had occurred, as recorded in your case-management system.
Affected systems — A preliminary list of affected systems, applications or data categories. You may refine this in subsequent updates.
Preliminary impact assessment — Your current understanding of the impact on confidentiality, integrity or availability. State clearly what you know and what you are still investigating.
Containment status — What actions you have taken to contain the incident, and whether containment is complete or ongoing.
Next steps — What investigation and remediation activities are planned, and when you expect to provide an update.
If you do not yet know the root cause, the full scope of compromise, or the exact number of affected records, state that clearly. The initial notification is not a final report. It is a timely alert to the regulator that an incident has occurred and that you are responding.
The 72-Hour Calculation
Once you have determined the discovery moment, the 72-hour clock is straightforward to calculate. The NCA ECC does not specify whether the 72 hours are business hours or calendar hours. In the absence of explicit guidance, regulated entities should treat the deadline as 72 calendar hours (three full days) from the discovery timestamp.
If discovery occurred at 14:35 on Monday, the notification deadline is 14:35 on Thursday. If discovery occurred at 18:00 on Friday, the deadline is 18:00 on Monday. Weekends and public holidays do not extend the deadline unless the NCA issues specific guidance to the contrary.
Common Pitfalls and How to Avoid Them
Waiting for forensic certainty — The most common reason for late notification is waiting for the forensic investigation to conclude. You do not need certainty; you need reasonable belief. If your IR team has confirmed unauthorized access, notify the NCA and continue the investigation.
Treating triage as discovery — An analyst triaging an alert has not triggered the clock. Discovery occurs when someone with authority to declare an incident has sufficient information to do so. Make sure your playbook specifies who has that authority.
Failing to document the discovery determination — If you cannot produce a timestamped record of when you determined an incident had occurred, you cannot prove you met the deadline. Require your incident response lead or CISO to document the discovery determination in the case-management system at the time it is made.
Delaying notification to avoid embarrassment — Some organizations delay notification in the hope that the incident will turn out to be less serious than initially believed. This is a regulatory and reputational risk. If you later determine the incident was less serious, you can update the NCA. If you delay notification and the incident is serious, you have compounded the problem.
Building the Capability Before the Incident
The time to define discovery is not during an active incident, when legal and compliance teams are debating the clock and the IR team is focused on containment. The time to define discovery is during incident response planning, when you can think clearly and build consensus.
A structured incident response readiness engagement addresses this directly. The firm's Incident Response Readiness & Tabletop Exercises service prepares organizations to respond by developing an incident response plan and playbooks, defining roles and escalation, establishing regulatory notification procedures, and conducting tabletop exercises for technical teams and executives. The engagement is delivered over four to eight weeks and includes an incident response plan and policy, a playbook set covering scenarios such as ransomware and data breach, a contact and escalation matrix, and an exercise report with improvements. Each playbook specifies the discovery criteria for that incident type, the evidence to timestamp, and the notification procedure.
Tabletop exercises test the playbook in a controlled environment. A realistic scenario—ransomware encryption detected on file servers, or evidence of data exfiltration—is presented to the incident response team and executive stakeholders. Participants walk through the detection timeline, identify the discovery moment, and simulate the notification process. The exercise reveals gaps in documentation, ambiguity in roles, and delays in escalation, which are then addressed in the plan updates.
Preparing for the Next Incident
The NCA 72-hour notification requirement is not negotiable, and the discovery moment is not always obvious. Regulated entities that define discovery in their playbooks, timestamp the determination in their case-management systems, and prepare their teams to notify with partial information will meet the deadline without waiting for forensic certainty.
If your organization does not yet have a documented discovery definition for each incident type, or if your last tabletop exercise did not test the notification timeline, now is the time to address it. The next incident will not wait for your playbook to be ready.
Prepare Your Incident Response Capability
CISO Consulting's Incident Response Readiness & Tabletop Exercises service helps NCA-regulated entities define discovery criteria, build notification procedures, and test their capability before an incident occurs. Delivered over four to eight weeks, the engagement includes incident response plan and playbooks, roles and escalation, regulatory notification procedures aligned to the NCA ECC, and tabletop exercises for technical teams and executives. Know exactly who does what in the first hours of an incident—and meet the 72-hour deadline with confidence.
