LexLint.ioBeta

Know the law your code answers to.

Law / Italy

Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Risk-Management Measures

D.Lgs. 4 settembre 2024, n. 138, Artt. 23 e 24

In force since .

A sector security regimes rule binding public and private bodies.

Obligation class
Security, Governance

What it requires

  • This binds an essential or important entity under Article 3; Article 7(5) names the cloud computing, online marketplace, online search engine and social-network platform providers among the entities it reaches, and the wider sector classes it also reaches (energy, transport, banking, health, water, digital infrastructure and public administration) are reached too, by declaring that you are an essential or important entity. An entity of sectors 3 and 4 of Annex I that Regulation (EU) 2022/2554 governs answers under that Regulation instead, because Article 3, paragraph 14 sets Chapters IV and V of this decree aside for it.
  • Adopt technical, operational and organisational measures adequate and proportionate to the risks facing the network and information systems you use in your activities or in providing your services, and to prevent or minimise the impact of an incident on the recipients of your services and on other services.NIST CSF 2.0ID.RA-06
  • Cover at least: risk-analysis and information-system security policies; incident handling, including the procedures and tools to carry out the Article 25 and 26 notifications; business continuity, including backup management, disaster recovery and crisis management; and supply-chain security.NIST CSF 2.0GV.PO-01
  • Have your management and governing bodies approve how these measures are implemented and oversee their implementation, see that they attend cybersecurity training, and promote similar training for your employees.NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02

These lines are LexLint's reading of the law's text. Also read by: Agenzia per la Cybersicurezza Nazionale (ACN) (guidance, recorded ).

In the frameworks

NIST Privacy Framework
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
NIST CSF 2.0
  • GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
  • GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
  • ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
  • PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
CIS Controls
  • 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
  • 8.2Turning on and gathering logs from the enterprise's systems.
FINOS AIGF
ENISA NIS2 guidance
  • 1.1Policy on the security of network and information systems
  • 1.2Roles, responsibilities and authorities
  • 2.2Compliance monitoring
  • 3.2Monitoring and logging
  • 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

Article 38 punishes an Article 24 infringement with an administrative pecuniary sanction (and, where the entity fails to comply with a formal notice within its deadline, a temporary disqualification of a manager); it creates no criminal offence for the infringement.

Penalty structure

Article 38(9)(a) sets the maximum administrative pecuniary sanction for an essential entity's infringement of Article 24 (excluding public administrations) at the greater of EUR 10,000,000 or 2 percent of total worldwide annual turnover for the preceding financial year, calculated per Commission Recommendation 2003/361/EC, with a floor of one-twentieth of that maximum. Article 38(9)(b) sets an important entity's maximum at the greater of EUR 7,000,000 or 1.4 percent, with a floor of one-thirtieth of that maximum, mirroring NIS2 Article 34(4) and (5). A public administration or publicly controlled entity within Annex III or Annex IV point 1 or 4 instead faces a fixed EUR 25,000 to EUR 125,000 sanction under Article 38(9)(c), reduced by one third for an important entity under Article 38(9)(d).

Rule
Higher of
As of
Currency
EUR
Fixed cap
10,000,000
Turnover percentage cap
2

Who enforces it

Enforcement body

Agenzia per la Cybersicurezza Nazionale (ACN), as the Autorità nazionale competente NIS, through CSIRT Italia and the Article 36 verification and inspection powers and the Article 37 enforcement powers.

Settledness

As of
Guidance link
https://www.acn.gov.it/portale/nis
Guidance body
Agenzia per la Cybersicurezza Nazionale (ACN)

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 24 requires an essential or important entity, defined by Article 3 against the sector annexes and including the cloud computing, online marketplace, online search engine and social-network platform providers that Article 7(5) names, to adopt technical, operational and organisational measures adequate and proportionate to the risks its network and information systems face, on a multi-risk approach covering at least risk-analysis and security policy, incident handling (including the procedures for the Article 25 and 26 notifications), business continuity and disaster recovery, and supply-chain security, transposing NIS2 Article 21.

Article 23 requires the entity's management and governing bodies to approve how these measures are implemented, oversee the implementation of the obligations in that chapter and in Article 7, and undergo cybersecurity training, and makes those bodies responsible for violations of the decree. Article 3, paragraph 14 sets Chapters IV and V of this decree aside for essential or important entities of sectors 3 and 4 of Annex I, to which Regulation (EU) 2022/2554 applies instead.

Article 1, paragraph 2 of that Regulation treats it as a sector-specific Union legal act for a financial entity identified as an essential or important entity, so that entity answers under that Regulation instead. Article 42(1)(c), a first-application rule, provides that until the deadline for complying with Articles 23 and 24 is eighteen months from the entity's receipt of the communication under Article 7(3)(a) and (b).

When LexLint raises it

When your app profile says your app operates a social platform, handles health records or runs an essential service.

Back to the example  ·  Lint your app

Page updated .