With Germany's NIS-2 Implementation Act in force since December 5, 2025, companies are required to report significant security incidents to the Federal Office for Information Security (BSI) within 24 hours. The obligation also covers attacks using manipulated QR codes, known as quishing. The following overview summarizes deadlines, responsibilities and required information.

Three Deadlines: 24 Hours, 72 Hours, One Month

Under NIS-2, an initial report of a significant security incident must reach the BSI within 24 hours. A detailed follow-up report is due after 72 hours, and a final report after one month.

Affected companies face several questions: which form applies, which details are mandatory, and what technical information the BSI requires. The following sections summarize the requirements.

Information Required in a Quishing Report

A complete report to the BSI includes, in addition to a description of the incident, several technical and organizational details:

NIS-2 Deadlines

Initial report after 24 hours, follow-up report after 72 hours, final report after one month

Indicators of Compromise (IoC)

Phishing URL, domain, and SHA-256 hashes of screenshots and web archives

Language and Format

Reports in German or English; machine-readable formats such as JSON facilitate further processing

Responsible Reporting Portal

Reporting form of the Alliance for Cyber Security on the BSI website

Distinction: The CVD Form Does Not Apply to Security Incidents

Reports are frequently misdirected: the CVD form (Coordinated Vulnerability Disclosure) is intended for vulnerability reports, not for security incidents.

Quishing Is Not a CVD Case

Quishing attacks are classified as security incidents, not vulnerability reports. Use the 'Alliance for Cyber Security' form, not the CVD form.

The correct form is available on the website of the Alliance for Cyber Security. Submitting a report via the wrong form can delay processing.

How Companies Report a Quishing Incident

First, document the incident in full: time of discovery, affected systems, the phishing URL, and screenshots or web archives as evidence. If known, also record the location of the manipulated QR code.

Then submit the initial report within 24 hours via the reporting form of the Alliance for Cyber Security. Additional details can be provided with the follow-up report after 72 hours.

Checklist: Technical Details for the Report

  • Incident ID and timestamp of discovery
  • GPS coordinates of the QR code location (if available)
  • SHA-256 hashes of screenshots and web archives
  • Impersonated brand and detection confidence score
  • Documentation in TXT and JSON format

BSI Report Template in QRTrust Enterprise

QRTrust Enterprise generates a pre-filled BSI report template for detected quishing incidents, including a deadline overview, IoC documentation, and a link to the Alliance for Cyber Security reporting form. The feature is available to administrators and customers in the portal.

Schedule Demo

About QRTrust

QRTrust is the leading platform for QR code security in Germany. With advanced AI technology, we protect businesses and consumers from quishing attacks and support NIS-2 compliance.