Runs an essential service, in Italy

Art. 1, Decreto-legge 21 settembre 2019, n. 105 · Read the law's page

• If you are an entity that the Prime Minister's administrative act includes in the national cybersecurity perimeter, prepare and update at least once a year a list of the networks, information systems and IT services on which your essential function or service depends, and send it to the National Cybersecurity Agency within six months of being notified of your inclusion (Decree-Law 105/2019, Article 1(2)(b)).
• Apply the security measures that the decree of the President of the Council of Ministers sets for those networks, information systems and IT services, including those on risk management, incident handling and the procurement of ICT goods, systems and services (Article 1(3)(b)).
• Before awarding a supply of ICT goods, systems or services for use on those networks in a category that the decree of the President of the Council of Ministers identifies, notify the CVCN, and use the supply only on the conditions and after the tests that the CVCN imposes (Article 1(6)(a) and (9)(e)).
• If you are identified as a supplier of goods, systems or services for those networks, cooperate with the CVCN's tests and bear their costs (Article 1(6)(b)).

Art. 1, commi 3, 8 e 9, Decreto-legge 21 settembre 2019, n. 105 · Read the law's page

• If you are an entity included in the national cybersecurity perimeter, notify incidents that affect the networks, information systems and IT services on your perimeter list to CSIRT Italia, through the procedures and within the time limits that the decree of the President of the Council of Ministers sets (Decree-Law 105/2019, Article 1(3)(a) and (9)(b)).

Art. 3, Decreto del Presidente del Consiglio dei ministri 14 aprile 2021, n. 81 · Read the law's page

• If you are an entity included in the national cybersecurity perimeter, notify CSIRT Italia of an incident listed in Annex A that has an impact on an ICT asset on your perimeter list, through the channels and procedures CSIRT Italia makes available (DPCM 81/2021, Article 3(1) and (4)).
• Make the notification within six hours of becoming aware of an incident in table 1 of Annex A and within one hour of becoming aware of an incident in table 2 (Article 3(4)).
• Supplement the notification promptly when you become aware of new significant elements, such as the vulnerabilities exploited or the indicators of compromise detected, unless the proceeding judicial authority has communicated a need for investigative secrecy (Article 3(5)).

Artt. 1 e 2, Legge 28 giugno 2024, n. 90 · Read the law's page

• If you are a central public administration, region, metropolitan city, large municipality or regional capital, urban or suburban public transport company, local health authority, or an in-house company providing IT, transport, wastewater or waste services for them, report any incident on the ACN taxonomy that affects your networks, information systems or IT services without delay and within 24 hours of learning of it, and make a complete notification within 72 hours of that moment (Law 90/2024, Article 1(1) and (2)).for a public body
• Make the report and the notification through the procedures on the ACN website (Article 1(2)).for a public body
• If ACN notifies you of a specific vulnerability you are exposed to, as an entity in Article 1(1), a national cybersecurity perimeter entity or an electronic communications provider under Article 40(3) of the Electronic Communications Code, apply the remedies it indicates without delay and within 15 days of its notice, unless technical or organisational reasons you have promptly communicated to ACN prevent it (Article 2).

D.Lgs. 4 settembre 2024, n. 138, Art. 25 · Read the law's page

• This binds an essential or important entity under Article 3; Article 7(5) names the cloud computing, online marketplace, online search engine and social-network platform providers among the entities it reaches, and the wider sector classes are reached as on this jurisdiction's companion risk-management row. An entity of sectors 3 and 4 of Annex I that Regulation (EU) 2022/2554 governs reports under that Regulation instead, because Article 3, paragraph 14 sets Chapters IV and V of this decree aside for it.
• Notify CSIRT Italia without unjustified delay, and in any event within 24 hours of becoming aware of a significant incident, with a pre-notification stating, where possible, whether the incident appears unlawful or malicious and whether it may have a cross-border impact.
• Follow with a full notification within 72 hours of becoming aware, updating the pre-notification and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise.
• Submit an intermediate report on CSIRT Italia's request, and a final report within one month of the notification (or, for an incident still ongoing at that point, a monthly progress report and a final report within one month of the incident's resolution).
• Where you are a trust-service provider, notify within 24 hours rather than 72 for an incident affecting the trust services you supply.

D.Lgs. 4 settembre 2024, n. 138, Artt. 23 e 24 · Read the law's page

• Adopt technical, operational and organisational measures adequate and proportionate to the risks facing the network and information systems you use in your activities or in providing your services, and to prevent or minimise the impact of an incident on the recipients of your services and on other services.
• Cover at least: risk-analysis and information-system security policies; incident handling, including the procedures and tools to carry out the Article 25 and 26 notifications; business continuity, including backup management, disaster recovery and crisis management; and supply-chain security.
• Have your management and governing bodies approve how these measures are implemented and oversee their implementation, see that they attend cybersecurity training, and promote similar training for your employees.
• This binds an essential or important entity under Article 3; Article 7(5) names the cloud computing, online marketplace, online search engine and social-network platform providers among the entities it reaches, and the wider sector classes it also reaches (energy, transport, banking, health, water, digital infrastructure and public administration) are reached too, by declaring that you are an essential or important entity. An entity of sectors 3 and 4 of Annex I that Regulation (EU) 2022/2554 governs answers under that Regulation instead, because Article 3, paragraph 14 sets Chapters IV and V of this decree aside for it.