Norad hack raises the incident clock question: when did you know?

The hack and the headlines

On an unspecified date, attackers gained access to systems at Norad, Norway's agency for development cooperation ^[1]. The agency reported that personal data of 20,614 registered individuals may have been accessed. The incident made the news, as these things do.

What tends to get less attention is the part that follows: the reporting deadlines, and the question of when the clock started.

When the clock starts

Norway, like Sweden and the rest of the EU, has implemented the NIS2 directive. Under those rules, if you run what the law calls an essential or important activity, you report significant incidents in three steps: an early warning within 24 hours of becoming aware of the incident, a full notification within 72 hours, and a final report within a month ^[2].

That phrase, "becoming aware", is where it gets interesting. The clock doesn't start when you have all the facts. It starts when you know enough to recognise that something significant has happened.

Think of it like losing your bank card. The duty to report it doesn't wait until you have worked out whether anyone used it. It starts the moment you realise it is gone.

Sweden's Cybersecurity Act came into force on 15 January 2026, with the same deadlines ^[3]. It covers 18 sectors, including energy, transport, healthcare, digital infrastructure and public administration. The law doesn't care whether you are ready. If you are in scope, you report.

The evidence question

Say a supervisor later asks why the early warning went out after 30 hours instead of 24. Your answer will rest on one thing: a record of when you first knew.

A log entry that says "incident detected at 14:32" is only as credible as the system that holds it. If the people who keep the log could also change it, the record is easy to challenge. Supervisors know that, auditors know that, and so does anyone who has ever been on the wrong end of a dispute.

That is the gap between having a log and having evidence.

How a sealed timeline works

Here, the thing to seal is each step of the incident as it happens: the first detection note, the decision to escalate, and each report as it is sent.

Sealing takes a fingerprint of the record, not the record itself, so the content never leaves your systems. You send the fingerprint to WitniumChain through the REST API, the SDK or the MCP server, and you get a witness ID back. The record stays where it is.

If someone later questions when you knew, anyone you share the record with can calculate the fingerprint again and check it against the sealed one. If they match, the record hasn't changed since you sealed it. Change a single character and it won't match.

What it shows is when each step was recorded, in a way nobody can quietly rewrite afterwards, even someone with administrator rights.

What it doesn't show is that the report was complete, or that the response was adequate. Those are separate questions. A sealed timeline just means the timeline itself holds up.

How it would work

1. When the incident is first detected, seal a note of what you know at that moment.
2. When you decide to escalate, seal that decision.
3. When each report is sent, seal it.

The first 2,000 witnesses a month are free. Read the full documentation at witniumchain.com/docs.

What this means for you

If you run an essential or important activity under the Cybersecurity Act, ask yourself these questions now:

• Who decides when an event counts as an incident, and how is that decision recorded?
• Where do those records live, and who can edit them?
• If a supervisor asked when you first knew about an incident six months ago, could you show them a record nobody could have changed since the day?

The law gives you 24 hours from the moment you know. It does not give you time to work out how to prove when that moment was.

What to watch

Sweden's Cybersecurity Act has been in force since 15 January 2026. The first reports under the new deadlines are already being filed. PTS, the supervising authority for several sectors, has published guidance on what counts as a significant incident and how to report it ^[3].

For the rest of the EU, the NIS2 transposition deadline was 17 October 2024, though implementation dates vary by member state ^[2].

If you work in one of the 18 covered sectors and have not yet checked whether you are in scope, this is the week to do it.