Ofcom NIS Incident Report Form
For further information please see https://www.ofcom.org.uk/phones-telecoms-and-internet/information-for-industry/guidance-network-information-systems-regulations 
	Ofcom NIS Incident Report Form	
1	OES name and the essential service it provides		
2	OES incident reference number		
3	Date, time and time zone of incident occurrence 		
4	Date, time and time zone of incident resolution		
5	Service impact duration		
6	Location / geographic spread of impact		
7	Informed SPOCs 		
8	Description of incident		
9	Primary Root cause:
Select one of:
System failure
Natural phenomena
Human error
Malicious action
Third party failure
Other (please specify)		
10	NCSC Cyber Attack Categorisation
Select one of:
C1 / C2 / C3 / C4 / C5 / C6 / Not a cyber attack		
11	Incident Severity
Select one of: 
High / Medium / Low		
12	Incident Impact:
Select one of: 
Red / Yellow / Green / White		
13	Impact on economic and societal activities
Select one of: 
Red / Yellow / Green / White 		
14	Action taken:
Please include information regarding any remedial action taken, and any other competent authorities, or CSIRTs, from either the UK, or EU states, that have been notified.		
15	Name and contact details for follow up questions		

Ofcom’s Guidance for completing the NIS Incident Report Form
Below is taken from the formal published guidance, and provides our explanations and guidance for OES which they must consider in completing our NIS incident report form set out above.
Row 1: OES name and the essential service it provides
The full name of the OES and the essential service it provides.
Row 2: OES incident reference number
If the OES has allocated any of its own incident reference number for internal use, such a reference number should be given to Ofcom.
Row 3: Date, time and time zone of incident occurrence
The date, time and time zone when the incident met or exceeded the NIS incident reporting threshold.
In the case of a voluntary reported incident which has not exceeded a NIS incident reporting threshold, the date, time and time zone when the incident first occurred.
Row 4: Date, time and time zone of incident resolution
The date, time and time zone when the incident was resolved or when services are fully recovered.
Row 5: Service impact duration
The period of time for which the essential service is unavailable or of degraded availability. This information will assist in determining the severity of impact.
Row 6: Location and geographic spread of impact
The city, county or country affected. An OES must inform us which member state(s) are affected if there is any cross-border impact. 
Row 7: Informed SPOCs
OES may need to inform more than one SPOC in some types of incident. For example, an OES may need to inform the SPOCs in other EU member states if an incident has cross-border impact.
Row 8: Description of incident
Description of the incident regarding what has happened and an initial statement of probable cause.
If an OES is reliant on a RDSP to provide an essential service and significant impact on the continuity of the RDSP service is the probable cause or contributor to the incident, the following information should be included in the description:
•	the RDSP name and the essential services that were affected;
•	the time the RDSP incident occurred;
•	the duration of the RDSP incident (This would be provided in the OES PIR);
•	information concerning the nature and impact of the RDSP incident;
•	information concerning any, or any likely, cross-border impact of the RDSP incident; and
•	any other information that may be helpful to Ofcom.
Row 9: Primary root cause
A Root Cause is the fundamental reason why an incident occurred. Please select one of the six mutually exclusive root causes listed below. 
System failure	The incident is due to the failure of a system i.e. without external causes for example a hardware failure, software bug or flaw in a procedure etc. 	
Natural phenomena	The incident is due to a natural phenomenon for example a storm, lightning, solar flare, flood, earthquake or wildfire etc.	
Human error	The incident is due to human error i.e. the system worked correctly but was used in an incorrect manner for example a mistake or carelessness triggered the incident.	
Malicious actions	The incident is due to a malicious action or actions for example a cyber-attack or physical attack, vandalism, sabotage, insider attack or theft etc.	
Third party failures	The incident is due to disruption of a third-party service like a utility for example a power cut or an Internet outage triggered the incident.	
Other (please specify)	If none of the above-mentioned root causes apply, please specify the nature of the root cause.	
Row 10: NCSC’s cyber attack categorisation
The NCSC classifies cyber attacks into six categories to improve incident response and resource allocation; details, including the definition of the six categories, can be found on NCSC’s website. An OES only needs to select one of the six categories if the incident involves a cyber attack element otherwise the OES should state “Not a cyber attack”.
Row 11: Incident severity
The severity of an incident indicates the impact of the incident from a technical perspective on the OES. Factors to consider may include:
•	the amount of additional effort or costs needed to mitigate, protect or recover from the incident;
•	the criticality of the systems affected (e.g. mission-critical SCADA systems);
•	the feasibility or availability of solutions or protection measures which mitigate the threat; and
•	adequacy of industry standards and industry best practices in mitigating the threat.

OES should assess the incident severity using the criteria set out in the table below. An incident falls within a given category if one or more of the criteria are met.

Table: Criteria of different level of incident severity
Incident Severity	Criteria	

High	•	Costs greater than £100,000 will be incurred to resolve the incident 
•	There are unrecoverable damages for example, data theft or data loss.
•	There was disruption to critical services.
•	No immediate solution is available	

Medium	•	Costs of between £5,000 and £100,000 will be required to resolve the incident.
•	There are no unrecoverable damages for example, data theft or data loss.
•	Critical services are not affected.	

Low	•	Costs less than £5,000 will be required to resolve the incident.
•	There are no unrecoverable damages for example, data theft or data loss.
•	Service availability was not affected. 	
Row 12: Incident impact
Incident impact indicates the scale of impact of the incident on the economy and society. This includes (but is not limited to):
•	Risks to the health and safety of the population, for example affecting emergency services;
•	Damages and costs for citizens and/or organizations affected;
•	Disruption of daily life;
•	Cascading effects in critical sectors;
•	Media impact and coverage; and 
•	Political impact and significance.

OES should assess the incident impact into one of the four possible categories using the criteria set out in the table below. An incident falls within a given category if one or more of the criteria are met.
Table: Criteria for different level of incident impact
Indicator	Criteria	

Red
(High)	•	The extent of the disruption and proportion of users affected falls within the red zone in the table below.
•	Cross-border impacts have occurred.
•	Damages and remedy costs totalling £100,000 or more.
•	There are cascading effects in multiple critical sectors.	

Yellow
(Medium)	•	The extent of the disruption and proportion of users affected falls within the yellow zone in the table below.
•	Cross-border impacts have occurred.
•	Damages and costs totalling £5,000 or more but less than £100,000.
•	There are cascading effects in multiple non-critical sectors.	

Green
(Low)	•	The extent of the disruption and proportion of users affected falls within the green zone in the table below.
•	There are no cross-border impacts.
•	Damages and costs totalling £1,000 or more but less than £5,000.
•	There are no cascading effects in other sectors.	

White
(Baseline)	•	The extent of the disruption and proportion of users affected falls within the white zone in the table below.
•	There are no cross-border impacts.
•	Damages and costs totalling less than £1,000.
•	There are no cascading effects in other sectors.
•	Just met the NIS reporting thresholds (Refer to the latest NIS Guidance).	
Row 13: Relative threshold for impact on economic and societal activities
Economic and societal activities impact refer to the possible damage to the national or international market. It may be difficult for an OES to determine the impact because they normally could not obtain the information required for evaluating the impact. 
The table below show the relative threshold for high (red), medium (yellow), low (green) and baseline (white) impact on economic and societal activities. 
Relative threshold for impact on economic and societal activities
Relative Threshold	Critical Service Impact	
	0 to 1
hours	1 to 2
hours	2 to 4
hours	4 to 6
hours	6 to 8
hours	8 to 10
hours	10+
hours	
Percentage of consumers affected	0% to 2% 								
	2% to 5%								
	5% to 10%								
	10% to 15%								
	15%+								
Row 14: Action taken
Please include information regarding any remedial action taken, and any other competent authorities, or CSIRTs, from either the UK, or EU states, that have been notified.
Row 15: Name and contact details for follow up questions
Please include the name and contact details of a person able to receive and respond to follow up questions.