OpenChainGraph Suite · ART-144 · wave 26

NIS2 Incident Significance Scorer (Art. 23 Reporting Threshold)

Score a cybersecurity incident against NIS2 Article 23 significance thresholds. Determines whether the incident meets reporting criteria, calculates the 24-hour early warning, 72-hour notification, and 30-day final report deadlines, and identifies the required notification recipients.

NIS2 Art.2324h / 72h / 30dCSIRT RecipientsActive Oct 2024W3C VC §13.11Zero PII

🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.

⏱ NIS2 Article 23 reporting clocks start from when the entity becomes aware of the significant incident. 24 hours — early warning to national CSIRT. 72 hours — full notification with impact assessment. 30 days — final incident report.

Scope

Root node of the nis2-incident-response chain (art-144→145). Assesses whether an incident crosses the NIS2 Article 23 significance threshold using six triggering factors: service disruption ≥1h, affected users ≥1,000, financial loss ≥€100K, third-party cascade impact, malicious act, or cross-border impact. Three or more triggers — or combined cascade+malicious — escalates to critical.

Presets

Incident Impact Metrics

Service Disruption Duration (hours) — threshold: ≥1h

Estimated Affected Users — threshold: ≥1,000

Estimated Financial Loss (EUR) — threshold: ≥€100,000

Entity Classification

Qualitative Triggers

Third-party cascade impact

Incident has caused or may cause significant impact on other organisations or critical infrastructure

Involves malicious act

Incident is the result of a deliberate attack, ransomware, espionage, or other malicious activity

Cross-border impact

Incident affects or may affect entities or users in more than one EU Member State

Result

Execution Hash & §4 Artifact

SHA-256 execution hash (JCS canonical — RFC 8785):

Run the AINumbers MCP tool `score_nis2_incident_significance`. Task: Score a cybersecurity incident against NIS2 Article 23 significance thresholds. Call it with arguments: {"policy_parameters":{"service_disruption_hours":4,"estimated_affected_users":5000,"estimated_financial_loss_eur":500000,"third_party_cascade_impact":false,"involves_malicious_act":false,"cross_border_impact":false,"entity_classification":"essential"}} Verify before trusting: call `verify_execution_hash` on mcp.ainumbers.co (https://mcp.ainumbers.co/mcp) with the parameter `claimed_hash` set to the returned `execution_hash`, passing the full artifact the run returned (the object containing `policy_parameters` + `output_payload` + `execution_hash`; equivalently `policy_parameters` + `output_payload` with `claimed_hash`), not the bare hash string, or re-run the in-page WebMCP tool `score_nis2_incident_significance`. Return the ledger link https://ledger.ainumbers.co/ so a human can re-verify without contacting us. PII rule: All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only. Open the tool with the sample prefilled: https://ainumbers.co/chaingraph/art-144-nis2-incident-significance-scorer.html#p=v1.H4sIAAAAAAAA_wHmABn_eyJzZXJ2aWNlX2Rpc3J1cHRpb25faG91cnMiOjQsImVzdGltYXRlZF9hZmZlY3RlZF91c2VycyI6NTAwMCwiZXN0aW1hdGVkX2ZpbmFuY2lhbF9sb3NzX2V1ciI6NTAwMDAwLCJ0aGlyZF9wYXJ0eV9jYXNjYWRlX2ltcGFjdCI6ZmFsc2UsImludm9sdmVzX21hbGljaW91c19hY3QiOmZhbHNlLCJjcm9zc19ib3JkZXJfaW1wYWN0IjpmYWxzZSwiZW50aXR5X2NsYXNzaWZpY2F0aW9uIjoiZXNzZW50aWFsIn0CJPFC5gAAAA

NIS2 Incident Significance Scorer (Art. 23 Reporting Threshold)

Ask your agent