LexLint.ioBeta

Know the law your code answers to.

Law / Italy

Decreto-legge 21 settembre 2019, n. 105, Perimeter Incident Notification

Art. 1, commi 3, 8 e 9, Decreto-legge 21 settembre 2019, n. 105

In force since .

A vulnerability and incident reporting rule binding public and private bodies.

Obligation class
Security, Reporting

What it requires

  • If you are an entity included in the national cybersecurity perimeter, notify incidents that affect the networks, information systems and IT services on your perimeter list to computer security incident response team (CSIRT) Italia, through the procedures and within the time limits that the decree of the President of the Council of Ministers sets (Decree-Law 105/2019, Article 1(3)(a) and (9)(b)).

These lines are LexLint's reading of the law's text.

If you get it wrong

Private right of actionNo

Penalty structure

Article 1(9)(b) sets an administrative fine of 250,000 to 1,500,000 euro for failure to make the incident notification within the prescribed time.

Rule
Fixed only
As of
Minimum
250,000
Currency
EUR
Fixed cap
1,500,000

Who enforces it

Enforcement body

The National Cybersecurity Agency (ACN), which since Decree-Law 82/2021 stands in for the Presidency of the Council of Ministers and the Ministry of Economic Development named in Article 1(12).

Settledness

As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Entities included in the national cybersecurity perimeter notify incidents affecting the networks, information systems and IT services on their perimeter list to the national computer security incident response team (CSIRT), under procedures and time limits that a decree of the President of the Council of Ministers sets (Article 1(3)(a)).

An incident notification made under the perimeter by an entity that also falls within the NIS2 decree satisfies that entity's incident notification duty under Article 25 of the NIS2 decree (Article 1(8)). Failure to notify within the prescribed time is punished by an administrative fine of 250,000 to 1,500,000 euro (Article 1(9)(b)).

When LexLint raises it

When your app profile says your app runs an essential service.

Back to the example  ·  Lint your app

Page updated .