ItalyDecreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Incident Notification
D.Lgs. 4 settembre 2024, n. 138, Art. 25
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds an essential or important entity under Article 3; Article 7(5) names the cloud computing, online marketplace, online search engine and social-network platform providers among the entities it reaches, and the wider sector classes are reached as on this jurisdiction's companion risk-management row. An entity of sectors 3 and 4 of Annex I that Regulation (EU) 2022/2554 governs reports under that Regulation instead, because Article 3, paragraph 14 sets Chapters IV and V of this decree aside for it.
- Notify computer security incident response team (CSIRT) Italia without unjustified delay, and in any event within 24 hours of becoming aware of a significant incident, with a pre-notification stating, where possible, whether the incident appears unlawful or malicious and whether it may have a cross-border impact.NIST CSF 2.0RS.CO-02
- Follow with a full notification within 72 hours of becoming aware, updating the pre-notification and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise.NIST CSF 2.0RS.CO-02
- Submit an intermediate report on CSIRT Italia's request, and a final report within one month of the notification (or, for an incident still ongoing at that point, a monthly progress report and a final report within one month of the incident's resolution).NIST CSF 2.0RS.CO-03
- Where you are a trust-service provider, notify within 24 hours rather than 72 for an incident affecting the trust services you supply.NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text. Also read by: Agenzia per la Cybersicurezza Nazionale (ACN) (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 38 punishes an Article 25 infringement with an administrative pecuniary sanction; it creates no criminal offence for a failure to notify.
Penalty structure
The same Article 38(9)(a) and (b) penalty tiers that govern an Article 24 infringement govern an Article 25 infringement: the greater of EUR 10,000,000 or 2 percent of worldwide turnover for an essential entity, and the greater of EUR 7,000,000 or 1.4 percent for an important entity, both excluding public administrations, which instead face the fixed EUR 25,000 to EUR 125,000 sanction of Article 38(9)(c), reduced by one third for an important entity under Article 38(9)(d); for such a body, a failure to notify an incident is sanctioned only on a specific repeat within five years (Article 38(14)).
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Agenzia per la Cybersicurezza Nazionale (ACN), as the Autorità nazionale competente NIS, through CSIRT Italia.
Settledness
- As of
- Guidance link
- https://www.acn.gov.it/portale/nis
- Guidance body
- Agenzia per la Cybersicurezza Nazionale (ACN)
What this law does
Article 25 requires an essential or important entity to notify computer security incident response team (CSIRT) Italia, without unjustified delay, of any incident with a significant impact on the provision of its services, on a graduated clock: a pre-notification within 24 hours of becoming aware of the incident, a full notification within 72 hours, an intermediate report on CSIRT Italia's request, and a final report within one month of the notification (or, for an ongoing incident, monthly progress reports and a final report within one month of its resolution).
A trust-service provider notifies within 24 hours rather than 72. CSIRT Italia in turn responds without unjustified delay and, where possible, within 24 hours of the pre-notification, with an initial assessment and, on request, guidance on mitigation, transposing NIS2 Article 23. Article 3, paragraph 14 sets Chapters IV and V of this decree aside for essential or important entities of sectors 3 and 4 of Annex I, to which Regulation (EU) 2022/2554 applies instead.
Article 1, paragraph 2 of that Regulation treats it as a sector-specific Union legal act for a financial entity identified as an essential or important entity, so that entity reports under that Regulation instead. Article 42(1)(c), a first-application rule, provides that until the deadline for complying with Article 25 is nine months from the entity's receipt of the communication under Article 7(3)(a) and (b).
When LexLint raises it
When your app profile says your app operates a social platform, runs an essential service or handles health records.
Back to the example · Lint your app
Page updated .