Breach notification They must tell you fast (e.g. within 24 hours) - your clocks start with their call
Section 19.4 says our clocks start on our awareness, so is the supplier’s 24-hour window the right target? NIS2 already requires an early warning within 24 hours of awareness, so a 24-hour supplier notice leaves almost no margin. Should the clause be shorter for critical suppliers, such as ‘without undue delay’ or 12 hours?