ItalyDPCM 14 aprile 2021, n. 81, Perimeter Incident Notification Clock
Art. 3, Decreto del Presidente del Consiglio dei ministri 14 aprile 2021, n. 81
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Security, Reporting
What it requires
- If you are an entity included in the national cybersecurity perimeter, notify computer security incident response team (CSIRT) Italia of an incident listed in Annex A that has an impact on an ICT asset on your perimeter list, through the channels and procedures CSIRT Italia makes available (DPCM 81/2021, Article 3(1) and (4)).
- Make the notification within six hours of becoming aware of an incident in table 1 of Annex A and within one hour of becoming aware of an incident in table 2 (Article 3(4)).
- Supplement the notification promptly when you become aware of new significant elements, such as the vulnerabilities exploited or the indicators of compromise detected, unless the proceeding judicial authority has communicated a need for investigative secrecy (Article 3(5)).
These lines are LexLint's reading of the law's text.
What this law does
Article 3(1) requires entities included in the national cybersecurity perimeter, from , to notify the Italian computer security incident response team (CSIRT) of an incident listed in the tables of Annex A that has an impact on an ICT asset within their remit. Article 3(4) sets the notification time limit at six hours for an incident in table 1 of Annex A and at one hour for an incident in table 2, running from the moment the entity becomes aware of the incident.
Article 3(5) requires the notification to be supplemented promptly when the entity becomes aware of new significant elements, such as the vulnerabilities exploited or the indicators of compromise detected. The Regulation entered into force on .
When LexLint raises it
When your app profile says your app runs an essential service.
Back to the example · Lint your app
Page updated .