# NIS2 on AWS — Incident Clock Checklist (July 2026)

Transposition deadline **17 Oct 2024** passed; national laws vary — confirm local CA.

## Scope

- [ ] Essential vs Important; sector + size thresholds
- [ ] Map Art. 21 ten measures → owners + AWS evidence

## Incident notifications (typical structure)

- [ ] Early warning ~24h of awareness of significant incident
- [ ] Incident notification ~72h (update)
- [ ] Final report ~1 month
- [ ] Parallel GDPR Art. 33 decision tree when personal data involved

## AWS wiring

- [ ] GuardDuty / Security Hub → on-call with NIS2 severity matrix
- [ ] Org CloudTrail retained; supply-chain vendor register

## Counter-case

NIS2 ≠ GDPR — classify which clocks fire before notifying.