ItalyDeterminazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification
Artt. 2-4, 6, 7, Determinazione ACN 14 aprile 2025, n. 164179
In force since .
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Obligation class
- Security, Reporting, Governance
As of .
What it requires
- If you are an essential or important entity under Legislative Decree 138/2024, adopt the basic security measures in Annex 1 (important entities) or Annex 2 (essential entities) for your governing bodies and cybersecurity risk management within eighteen months of receiving the communication that lists you as a NIS entity (ACN determination 164179, Articles 2(2) and 3(1)).NIST CSF 2.0GV.OC-03
- Be ready to notify the basic significant incidents of Annex 3 (important entities) or Annex 4 (essential entities) within nine months of receiving that communication (Articles 2(3) and 3(2)).NIST CSF 2.0RS.CO-02
- If you operate a top-level domain registry or provide domain name registration services, comply within eighteen months with Article 29(1) and (2) of Legislative Decree 138/2024, adopt and publish the policies in its paragraph 3, adopt cybersecurity policies consistent with Annex 1, and have your management bodies approve them (Article 4).NIST CSF 2.0GV.PO-01
- If you are a former essential-service operator, keep your existing measures for your OSE systems and notify the basic significant incidents of Annex 3 or Annex 4 from (Article 6).NIST CSF 2.0ID.RA-06NIST CSF 2.0RS.CO-02
- If you are a telecommunications operator with 1 percent or more of national users, or at least one million users, keep your existing security and integrity measures for your telco systems and notify the basic significant incidents of Annex 3 or Annex 4, including a service outage of more than one hour affecting more than 15 percent of national users, from (Article 7).NIST CSF 2.0ID.RA-06NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Settledness
- As of
- Open questions
- When did the day after the Directive (EU) 2015/1535 information procedure fall, which starts Articles 2(2), 2(3) and 3 of the determination?
What this law does
The determination of the Director General of the National Cybersecurity Agency (ACN) sets, for the first application of the NIS decree (Legislative Decree 138/2024), the basic specifications for the duties in Articles 23, 24, 25, 29 and 32 of that decree.
The basic security measures for governing bodies and cybersecurity risk management are set in Annex 1 for important entities and Annex 2 for essential entities, and the basic significant incidents are set in Annex 3 for important entities and Annex 4 for essential entities (Article 2).
The deadline to adopt the basic security measures is eighteen months, and the deadline for the incident notification duty is nine months, from the entity's receipt of the communication of its inclusion in the list of NIS entities (Article 3).
Top-level domain registries and domain name registration providers must comply with Article 29(1) and (2) of the NIS decree, and adopt and publish the policies in its paragraph 3, within eighteen months, and the management bodies must approve them (Article 4). Former operators of essential services must keep their existing measures for their OSE systems and notify the basic significant incidents from the date the determination entered into force (Article 6).
Telecommunications operators with 1 percent or more of national users, or one million users, must likewise keep their existing measures for their telco systems and notify the basic significant incidents from that date (Article 7). The determination entered into force on , and Articles 2(2), 2(3) and 3 enter into force the day after the completion of the Directive (EU) 2015/1535 information procedure (Article 10).
When LexLint raises it
When your app profile says your app runs an essential service or provides telecom services.