Input Parameters
Once a year or less
Trade press mention, no customer awareness.
<1% of customers affected, <1 hour.
<1K individuals, basic contact data only.
A few hours of engineering time. <€5K.
Assessment
€5,000
Annual Risk (capped at €2,000,000)
Severity
Minor
Cost per Incident
€5,000
Frequency
1x / year
Urgency
None
PHOSI String
Lik:Low/PuI:Min/SeI:Min/PII:Min/DCI:Min
NIS2 Notification Assessment
Below significant incident threshold
No NIS2 notification obligation triggered
Threshold criteria
Notification obligations (Article 23)
Within 24h
Early Warning
Notify your national CSIRT or competent authority that a significant incident has occurred.
- Indicate whether the incident is suspected to be caused by unlawful or malicious acts
- Note any cross-border impact
- No full analysis required at this stage
Within 72h
Incident Notification
Submit an incident notification with an initial assessment.
- Severity and impact of the incident
- Indicators of compromise (where available)
- Update any information provided in the early warning
Within 1 month
Final Report
Submit a final report covering:
- Detailed description: nature, cause, root cause analysis
- Measures taken and measures to prevent recurrence
- Cross-border impact where applicable
- If incident ongoing: progress report now, final report within 1 month of handling
NIS2 Directive (EU) 2022/2555, Article 23. Notify your national authority — in NL: NCSC for essential entities, RDI/sector supervisor for important entities. This assessment is indicative; legal counsel should confirm the obligation.
Risk Matrix
| Likelihood | Insignif. | Minor | Signif. | Damaging | Serious | Grave |
|---|
Annualized Incident Cost
| Likelihood | Insignif. | Minor | Signif. | Damaging | Serious | Grave |
|---|
Calibration Questions
These defaults are deliberately generic. Use these prompts to adjust the framework for your organization.
Export & Storage
PHOSI Calculator — Mid-Market Edition. Pre-filled for €50M–€500M revenue, 200–2000 employees, EU-based.
All values are starting points for calibration, not authoritative assessments. That requires Human Intelligence.
All values are starting points for calibration, not authoritative assessments. That requires Human Intelligence.