Article 44 establishes the CYBERSECURITY INCIDENT REPORTING regime for NCCS in-scope entities. Significant cybersecurity incidents (defined in Article 44(2) by reference to impact on cross-border electricity flows) must be reported to the ECCA + the EECCG within strict deadlines paralleling NIS2 Article 23: 24-hour early warning + 72-hour notification + 1-month final report. The reporting templates + classification thresholds are operationalised through the Article 8 joint methodology. Article 45 sets the cross-border-incident reporting protocols + cooperation between Member State competent authorities + ENTSO-E + the EU DSO Entity + ENISA. Article 46 establishes the EARLY WARNING SYSTEM for cross-border cyber-attacks affecting cross-border electricity flows: the EECCG coordinates real-time information sharing + threat intelligence + cross-border response activation. NCCS reporting applies CUMULATIVELY with NIS2 reporting where an entity is in scope of both regimes (the NCCS regime is sector-specific + supplements NIS2).
This control maps to 3 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.