The pre-drafted reporting templates are retained as standalone Module 9 artefacts. The template set includes the shared incident fact sheet (common fields across all regimes), the DORA initial notification template (four-hour deadline), the NIS2 early warning template (24-hour deadline), the CRA early warning template (24-hour deadline), and the Article 73 initial report template (2/10/15-day deadline).

Each template is pre-populated with static fields (entity identity, system identity, EU database registration reference) that do not change between incidents. Dynamic fields (timeline, scope, impact, containment actions) are clearly marked for completion during an incident. Regime-specific fields are clearly labelled.

The templates are reviewed and updated annually by the Legal and Regulatory Advisor, and tested during tabletop exercises. Any change to reporting requirements, authority designations, or reporting portal specifications triggers a template update.

Key outputs

• Pre-drafted templates for all applicable reporting regimes
• Static field pre-population with dynamic field markers
• Annual review and tabletop exercise testing
• Module 9 AISDP evidence