# Legal and compliance after an attack

> GDPR reporting duty within 72 hours, NIS2, cyber insurance, liability and crisis communication after a server attack.

Source: https://phpsos.de/en/compliance/  
As of: 25/10/2026  
Provider: PHP SOS, PHP emergency help and server security. Immediate help via WhatsApp: https://wa.me/491736494914?text=Hello%20PHP%20SOS%2C%20we%20need%20help%20with%20our%20PHP%20server.%20Company%3A%20%E2%80%A6%20Website%3A%20%E2%80%A6

GDPR reporting deadline, NIS2, insurance, liability, criminal complaint: general guidance for management. Not legal advice.

- [GDPR Reporting Obligation: 72 Hours After the Incident](https://phpsos.de/en/compliance/dsgvo-meldepflicht-72-stunden/): After an attack on a web server, a duty to notify the supervisory authority may apply. This page explains in general terms when the 72 hours start and what belongs in a report.
- [NIS2 and Web Server Security](https://phpsos.de/en/compliance/nis2/): NIS2 obliges many companies to carry out risk management and reporting. This page explains in general what that means for web servers and where to find reliable information.
- [Cyber Insurance: What Counts in a Claim](https://phpsos.de/en/compliance/cyberversicherung/): In an attack, early notice to the insurer, preserved evidence and coordinated steps often decide the payout. This page explains the typical points in general terms.
- [Liability of Management for IT Security Gaps](https://phpsos.de/en/compliance/geschaeftsfuehrer-haftung/): IT security is a management task. This page explains in general which duties of care apply and how managing directors can make decisions on vulnerabilities like PHP2Shell in a traceable way.
- [Filing a Criminal Complaint: Central Contact Points for Cybercrime](https://phpsos.de/en/compliance/anzeige-polizei-zac/): Companies have central contact points for cybercrime at the state criminal police offices in Germany. This page explains how a report after an attack works and what to prepare.
- [Crisis Communication After an Attack](https://phpsos.de/en/compliance/krisenkommunikation/): After an attack, good communication decides trust. This page explains whom to inform in which order and how a factual notice is structured.
- [What the BSI Recommends on PHP2Shell](https://phpsos.de/en/compliance/bsi-empfehlungen/): The BSI has declared warning level 3 (orange) for PHP2Shell and recommends an immediate update or temporary shutdown. This page explains what that means in practice.
- [Creating an IT Emergency Plan for Web Servers](https://phpsos.de/en/compliance/notfallplan-erstellen/): A good emergency plan fits on a few pages and answers the most important questions in an emergency. Here is how to create an IT emergency plan for your web servers.