ItalyLegge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties
Artt. 1 e 2, Legge 28 giugno 2024, n. 90
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Security, Reporting
As of .
What it requires
- If you are a central public administration, region, metropolitan city, large municipality or regional capital, urban or suburban public transport company, local health authority, or an in-house company providing IT, transport, wastewater or waste services for them, report any incident on the ACN taxonomy that affects your networks, information systems or IT services without delay and within 24 hours of learning of it, and make a complete notification within 72 hours of that moment (Law 90/2024, Article 1(1) and (2)).NIST CSF 2.0RS.CO-02
- Make the report and the notification through the procedures on the ACN website (Article 1(2)).NIST CSF 2.0RS.CO-02
- If ACN notifies you of a specific vulnerability you are exposed to, as an entity in Article 1(1), a national cybersecurity perimeter entity or an electronic communications provider under Article 40(3) of the Electronic Communications Code, apply the remedies it indicates without delay and within 15 days of its notice, unless technical or organisational reasons you have promptly communicated to ACN prevent it (Article 2).NIST CSF 2.0ID.RA-08
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- PR.PO-P10A vulnerability management plan is developed and implemented.
- NIST CSF 2.0
- CIS Controls
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
3 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Private right of actionNo
Penalty structure
Article 1(6) sets an administrative fine of 25,000 to 125,000 euro where a notification duty is breached repeatedly within five years, and Article 2(2) applies the same sanction to failing or delaying the remedial measures ACN indicates.
- Rule
- Fixed only
- As of
- Minimum
- 25,000
- Currency
- EUR
- Fixed cap
- 125,000
Who enforces it
Enforcement body
The National Cybersecurity Agency (Agenzia per la cybersicurezza nazionale, ACN), which applies the fine and may send inspections under Article 1(5) and (6).
Settledness
- As of
What this law does
Central public administrations, regions, metropolitan cities, municipalities above 100,000 inhabitants and regional capitals, urban and suburban public transport companies, local health authorities and their in-house IT, transport, wastewater and waste companies must report and notify the incidents on the National Cybersecurity Agency (ACN) taxonomy that affect their networks, information systems and IT services (Article 1(1)).
They must report any such incident without delay and within 24 hours of learning of it, and make a complete notification within 72 hours of that moment, through the procedures on the ACN website (Article 1(2)). For the municipalities, transport companies, local health authorities and in-house companies, these duties apply from the 180th day after the law came into force (Article 1(3)).
Repeated failure to notify within five years is punished by an administrative fine of 25,000 to 125,000 euro (Article 1(6)). The same entities, together with the entities under the national cybersecurity perimeter and the electronic communications providers named in Article 2(1), must apply the remedies ACN indicates for a specific vulnerability they are exposed to without delay and within 15 days of ACN's notice (Article 2(1)).
Failure or delay in applying them carries the same fines, unless technical or organisational reasons promptly communicated to ACN prevent or defer the remedy (Article 2(2)). The law entered into force on .
When LexLint raises it
When your app profile says your app provides telecom services or runs an essential service.