CSIRT Italia is Italy's national computer security incident response team: it operates within ACN (Italy's National Cybersecurity Agency) and receives the incident notifications that NIS2 requires of essential and important entities.
What it does
For a NIS2 company, CSIRT Italia is the recipient of the whole notification cycle: the pre-notification (pre-notifica) within 24 hours, the notification within 72 hours, any interim report and the final report. It is not just a mailbox: within 24 hours of the pre-notification, where possible, it gives initial feedback and, if you ask for it, guidance on mitigation measures (Article 25(7)). If the incident appears to be criminal in nature, it also guides you on reporting it to law enforcement.
CSIRT Italia also publishes alerts and bulletins on vulnerabilities and threats. Following its channels is an explicit requirement of the basic measures (measure ID.RA-08).
In practice
- Notifications are sent through ACN's reporting portal (segnalazioni.acn.gov.it), not by email.
- They are sent by the CSIRT liaison, designated by the point of contact by 31 December of the year of inclusion in the NIS list.
- You can also make voluntary notifications (Article 26) of near misses and threats: they do not create new obligations for you.
Legal reference
Article 2(1)(i), Articles 15, 25 and 26 of Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition; Article 7 of ACN Determination 127437/2026 (CSIRT liaison).
Related terms
Further reading
Sources
The sources are official texts, published in Italian.
- D.Lgs. 138/2024, Articles 15, 25, 26, Normattiva
- CSIRT Italia
- ACN, FAQ on basic measures and notifications
- ACN, Determination 127437/2026 (platform and NIS Services), Article 7, published on acn.gov.it