ItalyDecreto legislativo 10 marzo 2025, n. 23, DORA Major ICT Incident Reporting
Art. 4, Decreto legislativo 10 marzo 2025, n. 23
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Security, Reporting
What it requires
- If you are a financial entity within Article 2(1) of the DORA Regulation, report each major ICT incident, under Article 19 of that Regulation, to the authority that supervises you: the Bank of Italy, Consob, IVASS or COVIP according to your type (Legislative Decree 23/2025, Article 4(1)).
- If you are a banking or financial market infrastructure entity within Annex I to Directive (EU) 2022/2555, or are identified as critical under Directive (EU) 2022/2557, also give computer security incident response team (CSIRT) Italia your initial notification and each report of a major ICT incident, on the templates and within the time limits set under Article 20 of the DORA Regulation (Article 4(3)).
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
The Bank of Italy, Consob, IVASS and COVIP, which receive the reports of the financial entities each of them supervises, with CSIRT Italia receiving the banking and financial market infrastructure reports as well (Article 4(1) and (3)).
Settledness
- As of
What this law does
The Bank of Italy, Consob, IVASS and COVIP each receive the reports of major ICT-related incidents under Article 19 of the DORA Regulation from the financial entities within their supervision (Article 4(1)). Where more than one DORA competent authority supervises a financial entity, the receiving authority promptly passes the initial notification and each report of a major ICT incident, and any voluntary notification of a significant cyber threat, to the others (Article 4(2)).
Banking and financial market infrastructure entities within Annex I to Directive (EU) 2022/2555, and those identified as critical under Directive (EU) 2022/2557, also give computer security incident response team (CSIRT) Italia the initial notification and each report of a major ICT incident, using the templates and within the time limits set under Article 20 of the DORA Regulation (Article 4(3)). A financial entity that notifies a significant cyber threat voluntarily may send the notification to CSIRT Italia as well (Article 4(4)). The decree entered into force on .
When LexLint raises it
When your app profile says your app provides financial services.
Back to the example · Lint your app
Page updated .